November 22, 2009

John O'DuinnThe Crow Road by Iain Banks

“It was the day my grandmother exploded.”

A great opening line, and it made me stop my browsing in the bookshop to read on, a little curious. By the end of the first chapter, I was hooked and needed to buy the book. This coming-of-age story in rural Scotland is interwoven with social commentary and a family murder mystery. There were surprisingly lots of similarities with growing up in rural Ireland, and I found this book a really good read. Even if you did not grow up in rural Scotland (or Ireland), I think you’d still enjoy the book; you just might not get all the inside jokes or cultural references.

While I had heard of the author before, I always thought he wrote science fiction books that just didn’t work for me. This was my first time discovering that he wrote non-science fiction also, and I liked this book.

Burning Edge - Firefox2009-11-21 Trunk builds

Fixes:

  • Fixed: 407875 - Unprivileged users are not notified of security updates.
  • Fixed: 260264 - Popups from a site that is in the "Allowed List" (whitelist) are blocked, starting with the n-th popup (dom.popup_maximum).
  • Fixed: 521905 - Make extensions.checkCompatibility be per-application-version. (Mossop's blog post)
  • Fixed: 396392 - Support for getClientRects and getBoundingClientRect in DOM Range.
  • Fixed: 503481 - Implement async attribute of script element.
  • Fixed: 517804 - Try to avoid reflows and new invalidations during painting. (On Mac, this makes warm startup 13% faster.)
  • Fixed: 452319 - border-collapse rewrite.
  • Fixed: 519357 - Only load known components from app directory. (DevNews post)
  • Fixed: 524904 - [Windows] Add support for generic DLL blocklist.
  • Fixed: 525103 - [Windows] Block npffaddon.dll (malware) and old versions of avgrsstx.dll (AVG SafeSearch).
  • Fixed: 497665 - Images are downloaded multiple times if defined multiple times, on Shift-Reload / Ctrl+F5.
  • Fixed: 517224 - Firefox downloads CSS background images that it doesn't need (from overridden CSS rules).
  • Fixed: 77882 - getComputedStyle returns incorrect font-weight value if |font-weight:bolder| or |font-weight:lighter|.
  • Fixed: 512645 - Only clamp nested timeouts.
  • Fixed: 510082 - Silverlight 3 plugin elements don't repaint correctly.
  • Fixed: 520178 - [Windows] Minimized windows appear offscreen when restoring from session store.
  • Fixed: 499816 - [Windows] Minimizing Firefox does not release window focus.
  • Fixed: 440486 - [Windows] The FAX dialog disappear and Fax cannot be done from Firefox, but works otherwise.

mozilla-central pushlog for 2009-11-03 04:00 to 2009-11-21 04:00

Windows builds: Windows nightly (discussion)

Mac builds: Mac nightly

Linux builds: Linux nightly

Vladimir VukićevićDroid Almost Does

I purchased a Droid when they came out. It's my first Android device, and it's been an interesting experience. I am not a fan of the iPhone, and I've been using a Blackberry for the past few years (an 8700 first, then the original Curve, then the updated 8900). The Droid is a great looking device; I like the industrial look, with my only complaint being that the big gold-coloured area on the D-pad is way too garish; it would also have been nice had that area been a trackpad-like virtual trackball. The keyboard leaves a lot to be desired, though. It's a physical keyboard, which is nice, but it's no match for a Blackberry keyboard. Typing on it is slow and cumbersome, given the very wide layout, and some keys are very oddly placed. (I found it amusing that while the Blackberry has a dedicated unshifted key for "$", the Droid has a dedicated key for "?"...)

The feel of the OS is pretty nice, although some things are more sluggish than they really should be on an OMAP3 device. Stuart keeps telling me that Fennec has smoother panning in the browser, and I think he's right. It's not a deal breaker though; I find myself using the browser a lot to do all sorts of things that I never would have considered on my Blackberry (because, wow, the web browser situation there is awful), but that was a frustrating experience on my iPod Touch as well. I've spent a while "browsing the web" on my phone, which I've never been able to say I've done before.

But, it's still a phone, and while the voice portion isn't all that important to me, the overall communication package is. Coming from a Blackberry, the overall messaging situation on the Droid is simply horrible. Email, whether Exchange or IMAP, is a disaster. The email client seems designed for simple "lol r u there" type of messages, and even the message lists don't seem intended for people who get more than 5 messages a day -- turning a message list into landscape mode is worthless as you only get to see about 3-4 messages in the list (same view as in portrait mode, just along the much smaller axis of the display), no IMAP IDLE support etc. are all very strange on a top-end phone. Exchange support works ok for Calendar sync, but for email sync it would only download the first 1000 bytes or so of a message, including headers; this meant that I often only got to see the first sentence or two of an email. I don't know whether this is a problem with the Droid or our Zimbra Exchange connector, but switching to IMAP for work mail fixed that problem.

An recently-released version of the open-source K9 Email Client that works on the Droid resolves many of these issues, though it needs some polish. I might write some code there, since it's close to becoming a pretty good email solution.

The Gtalk client is probably in worse shape than email. It's almost as if Google entirely ignored Gtalk on this device (and I can't believe that would be Verizon's fault, since things like Google Voice work just fine). First, it's in general buggy -- it's crashed on me multiple times, often freezes when returning to it from another app (after clicking a link to the browser, for example), and often shows contacts as offline with a big red message despite the contact clearly having a green dot next to their name and responding to my messages.

In the browser and in other apps, you can share a web page with someone using a "Share with" button. The list you're presented is conspicuously missing Gtalk, despite having Facebook, Email, Messaging (SMS) and a random Twitter client I installed on there. What gives? All of these features are available on the Blackberry; I'm not sure if it was RIM that did the Gtalk app there, but can we get whoever it was to rewrite the Android one?

One of the best things about the Blackberry is the unified messaging; there's a single view where I can go to see all my emails, my gtalk conversations, my SMS messages, app updates, and whatever else. No such thing exists on Android. The closest thing is the notification bar, which requires a swipe down to use, and then only shows things that have come in since the last time you looked. I'd prefer a more time-based list that contains both old and unread items. Sounds like the Sony-Ericsson X10 might be doing some interesting things there, and I hope that someone figures out how to create an app like this. What it comes down to is that anything to do with communication is faster and simpler on my Blackberry, which is really strange; you'd think Google would have spent some time working this out, as everything else about the device is far superior to my 8900. I understand that more "enterprise oriented" customers (which apparently means those that like to use email a lot?) aren't necessarily the target market here, but they could've really attacked that market with some simple work that wouldn't have affected anything else.

The good news is that all of these are fairly straightforward software issues. The hardware is solid, and Google has shown that they'll do frequent upgrades of the OS. Given that the Droid is a "Google Experience" device, those updates should find their way to the device quickly. Some fixes, combined with getting Firefox Mobile on the Droid and other Android devices, will make this a great phone.

November 21, 2009

Chris HofmannOpen Source Education in Brasil

Last Summer I got the chance to visit several Universities while traveling around Brasil. One of the stops was to meet up with Prof. Fabio Kon and students at the University of Sao Paulo and the FLOSS Competence Center. For...

Mozilla Web DevelopmentMozilla Launches Facebook Security Quiz

Picture 2

Are you up for the challenge?

This week Mozilla launched the security quiz on Facebook. We encourage you to take the quiz and see how much you know about web security!

Similar to our plugin checker, the security quiz is a part of our larger effort to raise awareness about web security.

Help us spread the word and make the web safer for everyone. And don’t forget to check your plugins!

Blair McBrideStatus update

Was stubbornly fighting the flu for part of the week, so I didn’t get as much done this week as I had hoped.

Tab matches in Awesomebar

Status

Loose ends

  • Waiting on feedback

Next steps

  • Unit tests
  • Respond to feedback

Target for next week

  • Unit tests

Binding for untrusted text in security dialogs

No change.

Miscellaneous

  • Helped with some lightweight theme bugs for 3.6

Reflections

  • Sometimes, there is no good solution. But there is a best solution.

Related posts:

  1. Status update
  2. Status update
  3. Status update

Bryan ClarkRaindrop & Jetpack

The other day I did a quick hack using Raindrop & Jetpack to get new mail notifications from Raindrop. In total it took me less than an hour. It’s no Joe Shaw hack, so I don’t expect to get in the paper for this but I figured I’d share anyway. :)

This Jetpack checks Raindrop to see if there are new messages and bubbles them up as notifications if there are. Here’s the source code:

var messages = {}; 

function checkMail() {
 var api="http://localhost:5984/raindrop/_api/inflow/conversations/home?limit=10";
 jQuery.getJSON(api,
               function(data, textStatus){
                 jQuery.each(data, function(i,item){
                   if (item.unread) {
                     if (!messages[item.id] || messages[item.id] != item.messages.length) {
                       var n={title: item.subject,
                              body : item.messages[0].schemas["rd.msg.body"]["body_preview"],
                              icon : 'http://localhost:5984/raindrop/inflow/i/logo.png'};
                       jetpack.notifications.show(n);
                     }
                     messages[item.id] = item.messages.length;
                   }
               });
 });
}
setInterval(checkMail, 10000);

To try this out you’ll need Raindrop installed and running and Jetpack installed in Firefox.

Go to about:jetpack and copy the above code into the Develop tab, then click the try out this code link just below the Bespin editor.

If you don’t want to do all that you can just watch the video below (no sound, so you might want to play some music)

<object height="304px" width="650px"><param name="allowfullscreen" value="true"><param name="allowscriptaccess" value="always"><param name="movie" value="http://vimeo.com/moogaloop.swf?clip_id=7733464&amp;server=vimeo.com&amp;show_title=1&amp;show_byline=1&amp;show_portrait=0&amp;color=&amp;fullscreen=1"><embed allowfullscreen="true" allowscriptaccess="always" height="304px" src="http://vimeo.com/moogaloop.swf?clip_id=7733464&amp;server=vimeo.com&amp;show_title=1&amp;show_byline=1&amp;show_portrait=0&amp;color=&amp;fullscreen=1" type="application/x-shockwave-flash" width="650px"></embed></object>
View on Vimeo.

Sid Stammupdate on HTTPS security

Version 2.0 of my Force-TLS add-on for Firefox was released by the AMO editors on Tuesday, and in incorporates a few important changes: It supports the Strict-Transport-Security header introduced by PayPal, and also has an improved UI that lets you add/remove sites from the forced list. For more information see my Force-TLS web site.

On a similar topic, I've been working to actually implement Strict-Transport-Security in Firefox. The core functionality is in there, and if you want to play with some demo builds, grab a custom built Firefox and play. These builds don't yet enforce certificate integrity as the spec requires, but aside from that, they implement STS properly.

The built-in version performs an internal redirect to upgrade channels -- before any request hits the wire. This is an improvement over the way the HTTP protocol handler was hacked up by version 1 of Force-TLS, and doesn't suffer from any subtle bugs that may pop up due to mutating a channel's URI through an nsIContentPolicy. I'm not sure that add-ons can completely trigger the proper internal redirect, since not all of the HTTP channel code is exposed to scripts, and add-ons would need to replicate some of the functions compiled into the nsHttpChannel, opening up a possibility of obscure side-effects if the add-on gets out of sync with the binary's version of those functions.

Edit: The newest version of NoScript does channel redirecting through setting up a replacement channel in a really clever way -- pretty much the same as my patch. It replicates some of the internal-only code in nsHttpChannel, though, and it would need to get updated in NoScript if for some reason we change it in Firefox.

Mary ColvigReady for your close up?


Are you a Firefox fan? Or even better, a Personas fan? If so, we’d like you to star in a video we’re creating to showcase Personas. Here are the details:

  • Date: Monday, November 23, 2009
  • Time: 12:00 p.m
  • Location: Mozilla HQ, 650 Castro Street, Suite 300, Mountain View, CA 94041
  • Sign up sheet (create an account to add your name to the wiki or comment below to sign up)

Come as yourself – no fancy costumes needed – and meet other Firefox fans. We’ll treat you to lunch and make it worth your while! And, we promise none of these antics…

Jump up and Dance by Gary Pauck (Firefox Flicks)

Taras GlekDehydra Testsuite Passes on GCC 4.5

I spent couple of days fixing the remaining test-suite failures on GCC 4.5 trunk for Dehydra. Since the last time I looked into this, GCC went from crashing all over the place to only crashing if I did something bad. It was nice to discover that as a result of switching to 4.5 Dehydra users will get saner .isExplicit behavior and more precise location info.

Treehydra will take more work due to me misunderstanding GTY annotations.

By the way, I am really grateful for all of the people who contributed GCC 4.5 fixes so far. You guys have been a big help in getting Dehydra testsuite to 100% on 4.5. Looks like I will meet my goals to finish De+Treehydra by the end of the year in time for GCC 4.5 release and my “Introducing Dehydra to the Developer World”-type talk at LinuxConf.au.nz 2010.

Startup
I reduced my focus on startup speed at the moment to catch up on Dehydra. I plan to work on reducing xpconnect overhead during startup next, ie more of this bug.

Dietrich AyalaFirefox Startup Performance Weekly Summary


Current numbers are available on the Performance Snapshot page.

Summary, relative to Firefox 3.5:

  • Warm startup: For Mac, 36% better on 3.6 and 35% better on 3.7. For Windows, 5% and 5%. Flat on Linux. Also, Warm startup for Mac on 3.6 is a whopping 13% better than last week, due to the landing of bug 517804.
  • Cold startup: For Mac, 20% better on both 3.6 and 3.7. For Windows, not measuring yet. For Linux, we’re seeing a regression of ~9% across branch and trunk in the snapshot but not on the graphs, so I need to figure out where the discrepancy is.

This week’s activity:

  • Dirty-cold-Ts went live this week, thanks to Alice and Lukas. Example: cold startup with a large places.sqlite on Mac.
  • Joel is making progress on making a super-static Firefox in bug 525013.
  • Ben is making progress on the fastload replacement in bug 520309.
  • No updates on Windows cold-startup testing for Talos on bug 522807. I need to test on Vista, and turn off Pre/Superfetch.
  • Taras has patches up for service caching (bug 516085) and super-fast-path-ing of Components.* (bug 512584), however the latter he’s hit a wall, passing on to Blake or someone else who knows that code.
  • Ted landed rebasing on Windows in bug 484799.
  • Jonathan Kew has a new patch in bug 519445 for further reductions in Mac startup time spent in font system initialization, just about there…
  • Ryan Flint put a patch to minify JS on bug 524858, not working yet, but significantly reduced the size of shipped JavaScript files.

Projects in a holding pattern:

  • JARification: David abandoned moving JS modules into a JAR file, since those files are fastloaded. However, since we want things like post-extension-install restarts to be fast, and those cause fastload cache invalidation, we might want to do things like this anyways. I filed a bug for the same treatment for components. These are lower priority, since they’re not the normal startup case. Follow along with all JAR-ification via the tracker bug.
  • Startup Timeline: No updates, still not landed. Add [ft] in the whiteboard of your bug w/ the function names you want timed and David will generate it and update the bug.
  • Static Analysis: No progress on bug 506128. David needs to file a bug with the final log of named-yet-uncalled functions.
  • Dirty Profile Testing: No progress. Need to list scenarios, file bugs for each, generate Talos config patches and profile data, and then move it into Rel-Eng territory. Also, need to get a separate Tinderbox tree, since it’s going to cause a bazillion new columns.
  • Joel Reymont noted in bug 513076 that there are serious drawbacks to getting our libraries in the dyld shared cache on Mac, so has deprioritized that work.
  • No updates on Zack’s CSS parser changes in bug 513149.

As usual, more details and links are available on the project wiki, and we’re available to answer questions in #startup on irc.mozilla.org.

November 20, 2009

Caitlin LooneyProduct Shots of Firefox on N900


CNET UK recently reviewed Firefox running on the Nokia N900 (see Firefox Mobile on Nokia N900 hands-on photos: Fire in your trousers). I liked their product shots of Firefox in action (who wouldn’t?) and wanted to share some of those shots with you all today.Nice pic of the Firefox start page. We’ve incorporated a mini animation to help guide first-time users to navigate around the UI.

…A quick slide to the right reveals open tabs in thumbnail view so you can easily see what website you want to select. Tap on the corner of the thumbnail to delete the open tab, or tap on the button below to open a new one.

…A quick slide to the left shows the stowed away controls: bookmarking, back and forward, as well as preferences. Bookmark a page you like with one touch and edit the tag if you’d like.

Next to the new tab button is the WeaveSync button. Tap on that button and WeaveSync synchronizes and delivers your open tabs from your PC. This is a great example of how you can work away at your desktop, get up and go, pull out your mobile, and have everything waiting for you (browsing history, saved passwords, bookmarks, as well as open tabs) just as you had left it.

By tapping on the Tools button and going to your preferences in Firefox, you can select the add-on button to search and install your favorite add-ons from your mobile device. You can also manage your search engines here that appear at the bottom of the screen when you’re conducting a search with the Awesome Bar.

Ah yes, the glorious Awesome Bar in action. We know typing is hard so the Awesome Bar helps you get where you’re going in only a few keystrokes. With WeaveSync, the Awesome Bar gets that much more powerful as it recalls your browsing history from both your PC and mobile. See the search engines below so you can narrow your search further. Quick access to Wikipedia gets me one step closer to winning Bar Trivia Night. ;)

Hope you enjoyed the photos…I know I did. I’ll continue to post the latest and greatest screenshots on my Flickr stream: http://www.flickr.com/photos/missylooney/

Giorgio MaoneIE’s XSS Filter Creates XSS Vulnerabilities

Internet Explorer 8’s famous XSS filter can be exploited to perform successful XSS attacks against web sites which would be otherwise safe. In other words, XSS “protection” is helping XSS attackers, oh the irony.

Well, this is not exactly news among security researchers, but those aware of the details (including Microsoft of course, Eduardo “Sirdarckcat” Vela and myself) have kept a low profile so far. Check, for instance, slide #17 in my OWASP presentation, given two weeks ago.

However, after Microsoft left it unfixed for many months, someone apparently decided to whisper this dirty little secret in Dan Goodin (The Register)’s ear.

To Microsoft’s credit, this problem has no quick fix: in fact, it’s way worse than a simple implementation bug. Its root is a flawed design choice: when a potential XSS attack is detected, IE 8 modifies the response (the content of the target page) in order to neuter the malicious code. This is, incidentally, the only significant departure from NoScript’s approach, which modifies the request (the data sent by the client) instead, and is therefore immune.

Anyway, here’s the juice: IE 8’s response-changing mechanism can be easily exploited to turn a normally innocuous fragment of the victim page into a XSS injection. The attacker just needs a certain degree of control on the content of the web site to be injected: social networks, forums, wikis and even Google Apps are good prey. To be fair, Google Apps are not vulnerable anymore, since Google’s properties wisely choose to deploy the X-XSS-Protection: 0 header, which is the “safety switch” disabling IE 8’s XSS protection.

So, web site owners’ dilemma is, opt out or not opt out?
For browser users, there should be no dilemma at all ;-)

Robert StrongApp update status – week of 11/20

It has been a good couple of weeks. There are several bugs I am relieved that are now fixed for Firefox 3.6… especially that we now check if Firefox is in use prior to updating and prevent launching Firefox during an update. Also, checking for updates for users that aren’t able to apply updates. Beltzner did his usual beltzner thing by catching what I see as a major usability flaw in that the original patch notified users repeatedly for the same release until Firefox was upgraded which I was able to fix. I’m still kicking myself for not catching that myself.

Progress:


  • WOOT! Landed on trunk and 1.9.2 branch – Bug 407875 [Toolkit] – “Unprivileged users are not notified of security updates [All]“. The next bugs to fix that are similar are the dependent bugs of Bug 318855 [Toolkit] – “App update should provide method to update when the user doesn’t have privileges [All]“.
  • Landed on trunk and 1.9.2 branch – Bug 510501 [Toolkit] – “not granting UAC permission to updater.exe causes full update to be downloaded [Windows]“. The next bug to fix that is similar is Bug 336267 [Toolkit] – “If software update is disabled or “ask” after an update has been downloaded, the update should be disabled or asked [All]“.
  • Created a wiki page for the work on Bug 410639 [Toolkit] – “Provide ability to change update channel within the application [All]” and emailed dev-apps-firefox / dev-platform (followups to dev-apps-firefox) for this proposal.

Future targets (short work week so no way this will all get done):


  • Bug 336267 [Toolkit] – “If software update is disabled or “ask” after an update has been downloaded, the update should be disabled or asked [All]“
  • Investigate Bug 526441 [Toolkit] – “Unable to use FileUtils.jsm in nsExtensionManager.js.in on 1.9.2 due to reftest failures”.
  • Yes, I still need to blog about the lessons I’ve learned while trying to improve startup time for app update but the Firefox 3.6 took precedence.
  • Investigate Bug 529948 [Toolkit] – “Cannot check for updates on trunk when the download server is down” along with its friends

I’m taking Wednesday off so next week is a two day work week for me since Thursday and Friday are holidays.

Armen Zambrano Gasparnianhy-AM (Armenian) moving forward

Robert Sargsyan has been localizing Firefox into Armenian for a really long time through Narro.
He recently has contacted me to get things rolling since he has translated 98-99% (94% according to compare-locales) of the strings.

It is now my turn to get into the technical details and move it to mercurial. These are the steps that we have taken:
  • Robert ported the strings from 3.5 to 3.6 (Narro allows you to do this)
  • Through Narro's interface I exported the project and downloaded the zip file that it generates
  • I checked out my clone of the Armenian 1.9.2 tree
  • I overwrote my tree with the contents of the zip file
  • I run compare-locales like this:
    compare-locales /Users/armenzg/moz/repos/mozilla-1.9.2/browser/locales/l10n.ini .. hy-AM-1.9.2
  • I removed the files that were indicated to be removed
  • I pushed my changes to my repository
What comes next (if I am not mistaken)?
  • generate a langpack
  • submit it to AMO (submit page)
  • promote the add-on
  • get people's review
  • convince drivers to give us commit access
  • push the changes to the official Mozilla hy-AM repositories
We won't make it for 3.6 and I can't wait to see what the future holds for this language.

Big thanks to Serge!



Creative Commons License
This work by Zambrano Gasparnian, Armen is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Armen Zambrano Gasparnianlibconic package needed for Maemo builds has been deployed

Thanks to puppet we were once again able to fix this easily.

All that puppet told the slaves to do is to run this command:
su - cltbld -c '/scratchbox/moz_scratchbox -p apt-get --yes --force-yes install libconic0-dev'
 

What I did to fix this was:
  1. Check that a staging slave does not have that package "pkg-config conic --libs"
  2. Check that the file "targets/CHINOOK-ARMEL-2007/usr/include/conic/conic.h" does not exist
  3. Install it using a similar command that was used in a previous bug
  4. Check that "pkg-config conic --libs" returns what is expected "-lconic -ldbus-1 -lgobject-2.0 -lglib-2.0"
  5. Check that the conic.h exists where expected
  6. At this point we have a clear command to run by puppet and a "creates" argument.
  7. Deploy the patch in the staging-puppet server
  8. Login to another staging slave as root and run "puppetd --test --server staging-puppet.build.mozilla.org"
  9. Do checks 4 and 5 to see that the puppet changes took place
  10. Ask for review
  11. Commit and deploy to production-puppet
  12. Check a production like in step 8 and 9
  13. Check an hour later if a random slave has the change as well
Thanks to mfinkle for having written such a good description of the bug.

If you want to read more details check out "Bug 529462 - Add libconic package to Maemo build slaves"



Creative Commons License
This work by Zambrano Gasparnian, Armen is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Gervase MarkhamCommit Access Policy Draft

Currently, Mozilla has a large number of code trees in various source code management systems, many of which have differing requirements for access. This is confusing and difficult for both developers and administrators. This document is the first draft of a vision for what a unified commit access policy might look like. Having a clear commit access policy makes the lives of developers and administrators alike easier. ...

This new unified Commit Policy is likely to need careful review and improvement; I've been working on this for a while now but I'm still sure I haven't got it right first time. Comments welcome in mozilla.governance.

Wladimir PalantAMO getting serious about add-on security

Good news: AMO is finally getting serious about improving security of add-ons. Several bugs that I filed almost a year ago and didn’t have time to follow up on have suddenly seen some movement, even to the point of setting a two weeks deadline to resolve the security issues (thanks, Jorge). Sure, this approach won’t make you new friends and one add-on author preferred to remove his add-ons rather than fix them. But it is really overdue to start enforcing policies.

One particularly sore point are RSS feed reader extensions, every time I look into one I find security issues. In my understanding, an extension that regularly deals with untrusted content from the web should implement two security mechanisms:

  • Input sanitizing: remove any potentially dangerous content from the RSS feeds, particularly make sure no active content (JavaScript, Flash etc.) is allowed. Blacklist approaches like “allow everything but SCRIPT and OBJECT tags” aren’t worth anything because with something as powerful as HTML they are always easy to circumvent. It has to be a whitelist approach, there should be a list of tags and attributes that are allowed and everything else would be removed. Fortunately, nobody needs to implement this from scratch, Firefox already has the code necessary built-in and uses it for feed display rather successfully.
  • Just in case that the input sanitizer fails the feed reader should display the feed content in unprivileged context and establish a security boundary between it and browser’s chrome. I’ve written about this before.

With these two mechanisms the extension would be very unlikely to expose a security hole due to a developer mistake. Sadly, I’ve yet to see an RSS feed reader that would implement both, most didn’t even implement one properly. I hope this will change now.

Update (2009-11-20): Ouch, for Sage this comes too late. I filed a bug on this vulnerability in June 2008. So much on “We will be rewriting the sanitizer to use the Gecko parser” (the famous last words).

David AscherDear ISPs

Dear ISPs,

By far the largest set of support requests that we end up seeing for Thunderbird have to do with being unable to receive or send mail. By far the largest single cause of these failures is some unilateral change by the ISP which cause previously working configurations to stop working. In other words, people come to us for help solving problems we can’t solve. It makes us feel bad, it makes you look uncaring, and it certainly doesn’t help your customers (except for those cases when we go beyond the call of duty and help them as neighbors would, guiding them through the diagnostic & fix).

In our next revisions of Thunderbird, we’ll probably work on making our error dialogs better, so that we transmit whatever wisdom we can to your users to give them a fighting chance. But we can do better for your customers, if you get involved.

Let’s figure out how to work together to provide better experiences for your customers and our users. I’m quite sure that we can come up with solutions which would save you costs compared to having your customers tie up your tech support lines only to be rebuffed by your staff who often don’t understand how email systems work. It might also help you avoid commoditization…

Here are some ideas to start the conversation going:

  • Let’s make sure that our configuration of ISP databases works for as many users as possible. We’ll likely need to evolve the format and protocol over time, but we can only do that with input (some ESPs have already joined the effort, which is great!).
  • Consider making a useful add-on that would let you inform your customers of planned service downtime, configuration changes, etc. (no marketing messages, please, or your customers will not use it).
  • If there are changes we could make in Thunderbird that would help you help your customers, let’s talk!.

Together, we can figure out how to get your customers setup with a Thunderbird that works for them, for us, and for you.

Looking forward to a productive conversation,

– David Ascher
(dascher at mozillamessaging)

Mark SurmanWhat’s up w/ MozFdn – November Update


Here is a brief status update that I shared with the Mozilla Foundation board last week. This report is based on team goals outlined here.

In addition to Drumbeat, the last two months have focused communications and community support as well as launching a new education initiative. Highlights include:

November and December will continue to focus on early Drumbeat roll out and web development, as well new fundraising push built around the Namoroka park, which is the Firefox 3.6 namesake.

Program

2009 team goal: develop a small handful of programs that go beyond software as a way to promote Mozilla’s mission (e.g. education).

  • Core Mozilla Education work with colleges and Mozilla community grew as expected in late summer and early fall.
    • Mozilla-related courses and activities now underway at 13 schools on five continents, with participation from ten professors and almost a hundred students. Students working on Bespin, GCC optimization for Mozilla, Gecko, WebGL, Fennec, Firefox, Thunderbird.
    • Processing for the Web project particularly successful, energizing students to work on WebGL and Firefox. Ten students from Seneca College and Université d’Evry.
  • Received grant from MacArthur to fund Jetpack for Learning, a mashup of Mozilla Education and a Mozilla Labs design challenge. Launched challenge in late October.
  • Planning and early work on Drumbeat moving quickly, especially in late October. Web site mockups and year one plans have been posted, and first projects and events scheduled.

Communications

2009 team goal: dramatically increase awareness of Mozilla’s mission and public benefit nature amongst the broader public.

  • Ran Mozilla Service Week and OneWebDay campaigns in September. Significant community contributions and enthusiasm, although not as much as hoped in some regards.
  • Pointed one of five snippets on google search page to new ‘Better Internet’ page on mozilla.org, aiming to increase awareness of Mozilla’s mission.
  • Initial version of new engagement and fundraising database delivered by vendor, almost operational.

Community

2009 team goal: improve the Foundation’s ability to support, strengthen and grow the Mozilla community.

  • New Get Involved page launched on mozilla.org and community-wide contribute group established to make it easier for new people to get contribute to Mozilla.
  • Improvements made on a number of project governance fronts including: new Committer’s Agreement, commit access policy harmonization, dormant accounts.
  • MoFo-led Bugzilla Innovation Project made first release of web-friendly API, second release almost ready. One client has already been written to use it.

Organizational Development

2009 team goal: consolidate and strengthen the Foundation team, and develop a long term vision that clarifies the Foundation’s role within Mozilla.

  • Most organization development efforts in last two months focused on Drumbeat planning, and developing budget and goals for 2010.

Posted in mozilla

Daniel GlazmanOpera widgets without Opera... #3

YAY !!! Still a lot to do but it starts looking ok !

wima and 3 widgets

Deb RichardsonLast chance! Planet Mozilla Survey

I’m going to be closing the Planet Mozilla Survey this afternoon, so if you haven’t had a chance to respond to it yet, please do so ASAP! You can find the survey here:

Planet Mozilla survey.

Thanks!

Daniel GlazmanOpera widgets without Opera... #2

I have created a window gadget to manage widgets.

wima gadget

Bogomil ShopovFosdem 2010: Fighting with the beast

Here is the abstract of my talk proposal for Fosdem 2010:

20 years have passed since the fall of the Berlin Wall. But in many places it still exists in the minds of the people. New Europe is still fighting proprietary software and the FOSS application is still very limited.

The presentation deals with the application of FOSS in several countries from the Balkans and Central Europe, what is going on with the software patents, the open source browsers’ market share and the open standards.

Examples will be given for talks with the governments on the subject. The new and important topic of open digital government, in which everyone can participate on the principle of open source and open interfaces, will also be tackled.

In about 40 minutes the Speaker will present how freedom enters in this part of Europe, even only in its technological aspect.

In the beginning there will be a demonstration, representing the results that can be achieved through the use of open standards in Europe.

Stephen DonnerHelp us test search on SUMO (support.mozilla.com)

We're in the process of switching to a new (and improved) Sphinx-based search engine on SUMO (support.mozilla.com), and would *love*...

Stephen HorlanderSketch Day

Menu Sketch

Chris PearceReplay Debugging mochitest failures with VMWare Workstation 7

Ever since my last escapades with Replay Debugging in VMWare Workstation 6.5, I've been looking forward to improvements in this awesome technology. Thankfully the guys at VMWare have been hard at work, and now VMWare Workstation 7 now boasts improved Replay Debugging. I've found it much more robust and reliable, and Roc and I have already used it to debug some random orange bugs.

I've documented how to produce a Replay Debugging setup for debugging intermittent test failures in Mozilla mochitests, and put it up on MDC:

https://developer.mozilla.org/En/Debugging/Record_and_Replay_Debugging_Firefox

Now anyone can setup a machine to record and replay debug intermittent mochitests! A word of warning: you need a modern CPU in order to get good performance. I had poor performance when running on my two-year-old Core2Duo laptop, but replay performance is almost at real-time speeds on my shiny new Intel i7 950 box.

I still have two patches that need to be refined and then checked in, to facilitate replay debugging. The first enables the mochitest harness to loop forever on a test directory. The second enables you to set break points on specific JavaScript dump() calls, so you can break during replay close to where the action is.

We're far from having a fully automated record and replay setup, but we've made a start!

Seth BindernagelNew Reports Furnish Metrics to Our Localization Community

From the hard work by Mozilla’s Metrics team comes localizer metric reports that will show growth and usage data for each of our Firefox locales. The l10n-drivers team has been asking in meetings if we could show the impact that our volunteers are having with reports like the one sampled below. If you click the following link you will download a sample report.

Initially, I sketched out what I thought would be valuable information for the report, ran it by the l10n-drivers, and sent it to the metrics team to start implementation. In my opinion, an effective report provides both download and active daily user information to our localizers about their locales AND the geos in which their locales are being used. Let’s review the contents for those who might need a guide. Feel free to reference the attached screen shots as you read.

Locale-specific information

We are presenting both the download and active daily user (ADU) information (usages statistics and pie charts) for versions of Firefox. ADUs are based on the blocklist pings we track. (More on blocklist can be found at Mogamic’s post.)

Geographic-specific information

Each report will show both the download and blocklist for the top five locales inside a country where the localizer’s translated Firefox is most prominently used. In many cases, this is easy to map. Locale code “fr” is probably most prominently used in France. “de” in Germany. “es-ES” in Spain. In some cases, we’ll have to make guesses, like for our Kurdish localizers. Finally, we will provide a list of the top ten countries (by average blocklist pings) where the localizer’s Firefox is being used.

For the first time, our community of l10n volunteers will have a more comprehensive set of data points to help measure the progress and spread of their work. By providing both locale and geographic information, these reports illustrate the impact that each localization teams is providing.

Below are two images of a sample two page report.

Sample Localizer Report (page1)

and

Sample Localizer Report (Page 2)

ShareThis

Dave DashPalm Pre: Always hot

So I borrowed a Palm Pré that we had at Mozilla to see what it was like. I was at first very excited, I remember before the Pre was released there was a lot of talk about how awesome-fantastic it was going to be. The stories of awesomeness sort of died, and I had thought nothing of it.

Immediately upon using the Pre I figured out why. In short, it's a crappy phone. It makes a very good attempt to do a lot, but it does them with such piss-poor performance, that nothing good is noticed.

I am disappointed. It's not even in the same class as an iPhone - maybe a future generation of Palm devices will be, but not this one. I was hoping WebOS would be a good alternative to the iPhone. It looks like Google will be doing that, though their phones haven't impressed me much either. I am hoping that maybe this phone is just a dud.

Here's what I didn't like: * The Palm was always hot. * The first run experience is painfully slow. * The first run was an indicator of things to come, startup and shutdown are ridiculously slow. * Every application is slow to render. * Not all elements of an app render. * The keys are too small. Some people aren't migrating from a Treo and aren't used to mini keys. * No soft keyboard. * The palm website doesn't let you use plus-style addressing * Media Mode was not self explanatory - and forced the phone to not work. * Network would constantly drop out. Couldn't use a lot of the data features. * Phone calls didn't work so great. * Did I mention it was ass slow, even the dialing program was slow. * The battery dies quickly * I could only cut/paste when composing, but I couldn't cut a string of text from an email. * Felt too much like an old palm

Despite the sadness there were a few good things:

  • When it did fetch email, and other notices, it displayed them nicely
  • The unification of Facebook and Gmail was pretty cool - it also made me want to trim some of those friends from highschool off my facebook - I ain't ever gonna call em.
  • The Icons were pretty.
  • The card interface was interesting.
  • The travel charger could be modified to work in non US chargers fairly easily.

All in all, I'm glad that I had a chance to try out this device. It showed me, that user interfaces above all need to be very fast and responsive. Furthermore, everything you try to do should be done exceptionally well. I'm hopeful that software updates can alleviate some of the problem, but I think the root of the problem is slow hardware.

Blog of MetricsIs Firefox Approaching 50% Market Share?

At least in one large region of the world, the answer is “yes”.

The folks at Gemius have been kind enough to aggregate their individual country data (e.g., www.en.ranking.pl/) into a single view across their entire sample – a sample totaling more than 60 Billion page views each month. For an overview of the various market share providers and their samples, please read here.

We’ll eventually look to expand the conversation around this data, but for now, we’ll highlight just one breathtaking view. The chart below shows weekly browser market share data since the beginning of 2007 and it includes aggregated data from across nine countries – Czech Republic, Bulgaria, Estonia, Hungary, Lithuania, Latvia, Poland, Russia, and Ukraine.

gemius_aggregate

Aakash DesaiFennec Quality Update – The Team MOQA Effect


It’s been awhile since the last Fennec QA Update by Joel, so we felt that now was as good a time as any to provide another update. This is especially true as we’re getting closer to a final release with the Fennec 1.0 Beta 5 out the door now. Team MOQA has been really busy making Fennec the best mobile browser it can be over the past few months. With all the effort we’ve put in for quality execution on manual and automated testing, we knew the project was getting somewhere. But we had no idea how far until we started playing around with Bugzilla’s report charts tool. Here’s what we found:

Basically, we literally and figuratively went crazy in August and September with the number of bugs verified, but it opened up a whole bunch of usability issues in the project that started to bring the quality of the project around in October. The number of bugs fixed per week in the project before August was 7-8, but since August its gone up to 37-38. Now, this can be attributed to a whole bunch of things, but at the end of the day a person has to ask themselves if the overall quality of the project they’re working on has gotten better through their hard work. I think its safe to say that such a huge jump in bugs in a fixed state was attributed to developers having a larger number of bugs to work on that could be fixed…and that’s something we can hang our hats on.

With that said, we’re not done yet. Team MOQA has a couple more things up our sleeves that will really shore up some of the loose ends relating to quality and they’re coming hard and fast. So be ready for some hawtness with your Mozilla-powered mobile browsing in the near-future.

Things to Look For:
- WinMo Talos up and running soon
- Developing an extension to developer browser-chrome tests

Things Done:
- A robust system to move test and performance automation to any new platforms that crop up in the future (oh, and they will on the mobile front).
- xpcshell unit tests up and running
- We now have Release Test Tracking Pages for every release
- A String Guide (It’s a subgroup within the testrun) for localizers to find Fennec UI elements that correspond with the strings they localize in .dtd and .properties files within the mobile-browser source code.

Raw Stats (By Team MOQA since Joel Maher’s last Fennec QA Update on 6/30/09):
- 1092 bugs verified
- 276 bugs filed
- 64 Bugs filed in Testdays

Melissa ShapiroMozilla Security Quiz Live on Facebook!

Today, we released the Mozilla Security Quiz to the world! We're very excited to share the application with everyone.

You can go take the quiz here: http://apps.facebook.com/mozillasecurityquiz

Months ago, we sat down to talk about how - in addition to the work we were doing with security research and technical communities - we could have a direct role in educating users about online security. We saw an opportunity to communicate information that we felt was very important - key tips for keeping people safe online.

While we were working through the concept, the marketing and web development teams were in tight coordination with Mozilla's world-class security experts to make the survey adhere to Mozilla stringent privacy requirements. Where most Facebook applications allow developers a lot of access to personal data, we wanted to collect as little information as possible. In fact, we only wanted to see how people did on the quiz, we didn't care about location, gender, education, etc. To make sure we weren't collecting any secondary information, we hashed the Facebook user ID. This means that neither Mozilla, nor anyone else, can tell who answered which questions or what their responses were.

Please go check out the quiz and let us know what you think!

Big thank yous to:
Sarah Doherty
John Slater
Mike Morgan
Johnathan Nightingale
Brandon Sterne
Laura Mesa
AllWidgets
Elise Allen

Sarah DohertyGo Take Our Mozilla Facebook Security Quiz!

I’m really excited to announce the launch of the Mozilla Facebook Security Quiz!

A few months ago, we sat down with our security team to talk about how we could reinforce our thought leadership beyond security research and technical audiences and have a direct role in in educating users about online security.

At Mozilla we are always interested in new ways of reaching our audience and directly communicating. With our Facebook group reaching close to 600,000 members, we thought this was a unique way to get in front of our non-technical web users (regardless of what web browser they use) and share some great information on how to help stay safe while browsing. Since this is our first foray into the world of Facebook applications it will not be localized and will only be available in English.

Most Facebook applications are notorious for capturing lots of user data. One of the coolest things about our app, is that we have made sure that there will be no personal data captured by Mozilla. We even go the extra step of hashing out the Facebook user ID.

Like all projects, this was a wonderful collaboration from many people both internal and external to Mozilla. I wanted to give a huge thanks to our security and web dev teams, AllWidgets, Elise Allen, John Slater, Melissa Shapiro and Mike Morgan, Jonathan Nightingale, Brandon Sterne, and Laura Mesa.

So please, go out and take the quiz. Share it with your friends. Post to Twitter and your favorite social networking sites and let’s get this party started!

The Mozilla BlogTake the Mozilla Security Quiz on Facebook!

This afternoon, we’re excited to release a brand new Mozilla application on Facebook. The app is a 5 question quiz designed to teach users some quick tips about how to stay safe online. At the end of the quiz, you’ll be prompted to go check out our newly refreshed security page on the Mozilla website.

Facebook applications are notorious for capturing lots of data about the user. That’s simply not how we roll at Mozilla. We took the extra step of hashing the facebook user ID to ensure that if you take the quiz all of your personal data will stay with you. The only thing we’ll know is how quiz-takers (in aggregate) scored on the quiz.

Go take the quiz and find out if you’re a security ninja or a security newbie!


November 19, 2009

Mozilla ITMozilla Scheduled Downtime – 11/19/2009, 5pm – 11pm PST (0100 – 0700 11/20/2009 UTC)

We will have a scheduled maintenance window tonight from 5:00pm to 11:00pm PST. The following changes will take place:

Please let me know if you have any reason why we should not proceed with this planned maintenance. As always, we aim to keep downtime to as little as possible, but unexpected complications can arise causing longer downtime periods than expected. All systems should be operational by the end of the maintenance window.

Feel free to comment directly if you see issues past the planned downtime.

Vladimir VukićevićAndroid Hacking (Part 1 of probably many)

I've been looking to understand the Android OS better, so that I can answer some questions and create plans for getting Gecko/Firefox running on Android-based devices. One of the first questions I asked was, "How do Android apps start?" They're clearly separate processes while they're running, but it wasn't clear how they were launched. It turns out, there are a couple of pieces here. I'm going to describe what I've discovered here, in case it's useful for someone else; I haven't been able to find much of this information, largely because I don't think many people need to know any of this.

At boot time, a special instance of the Java VM is launched, called the Zygote. This process loads a bunch of the core Java classes and performs initial processing of them, making it possible to avoid this step for each app launch. Once the initial work is done, the process listens to a socket and waits for requests.

To launch an app using the Zygote process, a command-line tool called "dvz" can be used. It sends its arguments to the Zygote, which will fork and then start executing the main method in a given class.

So, we have these steps, dealing with the Zygote process:

But, that's not fully how a new Android Activity is started. It's a bit of a roundabout process. To launch a new Activity, the ActivityManagerService is notified with an activity start request, including things like the name/class/etc. of the activity. It puts that information in a list of activities to run. Then, a new process is started with the main from ActivityThread. This new process then contacts the ActivityManagerService and asks, essentially, "what app am I?". The service then gives it the name of its activity class and other info, which is then loaded, and a message is enqeued on the main thread to instantiate the new activity and send it an onCreate() message.

This is interesting because it means that apps are not launched directly, but instead somewhat indirectly through specializing a generic "Activity" process for a specific activity. A side effect of this is that I couldn't find a way to actually register an app with the ActivityManagerService if it wasn't launched by it. So, to be a full Android app, you have to go through this normal startup process.

JNI Bridging

One of the difficulties in porting Gecko to Android is that the Android platform is built around Java, whereas Gecko is very much all native C/C++. However, there is a fairly good native bridge layer, JNI, which is fairly heavily optimized by Dalvik. So, the simplest way to connect these two is to write a shell app in Java, which bridges events, messages, paint requests, etc. to the native code for handling.

As a proof of concept of this, I wrote a simple test app. It's fairly straightforward, with a few wrinkles. Most of this stuff can be done with the stock Android SDK and NDK -- except painting. The only API that the NDK exposes for graphics is OpenGL ES. This is fine, but in some cases you may want to access Skia directly from native code. This is possible, but requires version-specific code to accomplish. You can ship multiple versions of your JNI glue layer, optimized for each Android version (or even platform), and load the right one during your app startup on the Java side.

This is, of course, not very portable, robust, or guaranteed to continue to work by Google, but it's possible. There are some very rough hacks in the test app, but for the most part it demonstrates that this approach can work fine.

Next up, I'll probably blog about porting issues for large native apps, including library compatibility, Bionic, and integrating into a non-ant-based build system.

QMOTestday tomorrow on Firefox 3.6 with the L10n and QA Communities!

This is a quick reminder that a test event will be held tomorrow from 7AM - 5PM PDT on Firefox 3.6 with the L10n and QA communities joined together! The plan is to play around with the new features and performing exploratory testing as well. For those that are interested, this will be a chance for people to possibly sign up and own the testing of these new features for the next release!.

Our Fx3.6 Test Lead, juanb, tchung as well as sethb and Pike will be available through IRC Chat ( channel #testday on irc://irc.mozilla.org ) to help with any of your questions/comments/suggestions.As for where you can find the latest beta build, go to http://www.mozilla.com/en-US/firefox/all-beta.html

For more information, here's our event details page:
http://quality.mozilla.org/events/2009/nov/20/testday-l10n-and-qa-test-f...

Mark SurmanCould Mozillians help reinvent local news?


Recently, I noticed Knight Foundation and Sunlight Labs blogging together. The topic: rallying Sunlight developers to join the Knight’s efforts to reinvent local news for the internet era. And, in particular, to join the Knight News Challenge.

By collaborating with Sunlight, Knight is reaching out to developers and designers who are using internet thinking to change how government works. If these people are good at coming up with ways to internet-ize government, why not see if they can do the same for local news? Smart.

This got me to thinking: could Mozilla or Mozillians play a role in Knight’s efforts to create sustainable, inspiring local news that looks and feels like the internet? Certainly, the Knight Challenge criteria align well with Mozilla’s values:

The Knight News Challenge projects meet three criteria: 1) use digital, open-source technology to 2) distribute news and information in the public interest 3) to a local, geographic community.

Open source. Public benefit. Community. And, there a number of people who’ve participated in the past feel more ‘Mozilla’ than ‘local news’:

Past Knight News Challenge winners include leading innovators at the intersection of technology and information – folks like Sir Tim Berners-Lee, inventor of the World Wide Web and a 2008 Knight News Challenge winner, and Adrian Holovaty, co-creator of the Django programming framework and originator of one of the first Google Maps mashups, which evolved into his 2007 Knight News Challenge award.

While I’ve only just glanced at all the Knight and Sunlight stuff quickly, it does feel like there could be some useful connections here. Maybe simply by developers or others from the Mozilla community proposing ideas to Knight? Or maybe, at some point, through a more joint initiative through Drumbeat? I’m going to think on it a little and possibly post again. In the mean time, I’d welcome comments / brainstorms / proposals from any Mozilla people reading this post.

PS. The current Knight News Challenge deadline is December 15. If you have an idea, enter. It’s a really simple, short process. The web site is: www.newschallenge.org Posted in mozilla

hacks.mozilla.orgweb developer survey: 5,000+ responses from 119 countries!

A few weeks ago, we launched a new survey for Web developers. We wanted to learn more about what you are interested in to build the Mozilla Developer Network tailored to your needs.

Thanks to your help in spreading the word about the survey, we surpassed our goal of 5,000 responses! The survey is now closed and we’re processing the data. We’ll post results here on the hacks blog and tweet about them on @mozhacks in the next few weeks.

Given the positive feedback about this initiative, we’re planning to repeat the survey on a regular basis to show trends in the Web developer world over time. For example: what tools and technologies are most popular at a give time around the world? The next iteration should be coming in a few months, and we’ll ask for your help again to make sure the participation is as broad as possible.

Thanks for joining this effort, and stay tuned for the results!

Mitchell BakerState of Mozilla and 2008 Financial Statements

Today we are posting our audited financial statements and tax form for 2008. We have also posted our FAQ. As in past years, I’ll use this event as an opportunity to review both our financial status and our overall effectiveness in moving the mission forward.

Financial

The financial highlights are:

  1. Mozilla remains strong financially despite the financial crisis of 2008. Our investment portfolio was somewhat reduced, but overall revenues remained steady and more than adequate to meet our needs. We continue to manage our expenses very carefully.
  2. Mozilla remains well positioned, both financially and organizationally, to advance our mission of building openness, interoperability and participation into the Internet.

Our revenue and expenses are consistent with 2007, showing steady growth. Mozilla’s consolidated reported revenues (Mozilla Foundation and all subsidiaries) for 2008 were $78.6 million, up approximately 5% from 2007 reported revenues of $75.1 million. The majority of this revenue is generated from the search functionality in Mozilla Firefox from organizations such as Google, Yahoo, Amazon, eBay, and others.

2008 revenues include a reported loss of $7.8 million in investments in the Foundation’s long-term portfolio (approximately 25%) as a result of economic conditions and investment values at the end of 2008. Excluding investment gains and losses, revenues from operational activity were $86.4 million compared to $73.3 million in 2007, an annual increase of 18%.

Mozilla consolidated expenses for the Mozilla Foundation and all subsidiaries for 2008 were $49.4 million, up approximately 48% from 2007 expenses of $33.3 million. Expenditures remain highly focused in two key areas: people and infrastructure. By the end of 2008, Mozilla was funding approximately 200 people working full or part-time on Mozilla around the world. Expenditures on people accounted for roughly 58% of our total expenses in 2008. The largest concentrations of people funded by Mozilla are in the U.S, Canada, and Europe with smaller groups in China and New Zealand and individuals in many parts of the world.

Total assets as of December 31, 2008 were $116 million, up from $99 million at the end of 2007, an increase of 17% to our asset base. Unrestricted assets at the end of 2008 were $94 million compared with $82 million in 2007, a 15% increase. The restricted assets remain the same as last year: a “tax reserve fund” established in 2005 for a portion of the revenue the Foundation received that year from the search engine providers, primarily Google. As noted last year, the IRS has opened an audit of the Mozilla Foundation. The IRS continues to examine our records for the years 2004-2007. We do not yet have a good feel for how long this will take or the overall scope of what will be involved.

Total grants, donations, and contributions in 2008 were approximately $1 million matching the approximately $1 million of 2007. Mozilla supported projects such Mozdev, Software Freedom Conservancy, and accessibility support for the jQuery library, HTML 5 video, and Firebug.

We believe that Mozilla’s financial setting will continue with relative stability. We continue to use our assets to execute on the mission.

Moving the Mission Forward

2008 was another exciting and robust year for Mozilla. Our scope of activities continued to grow, our community of committed contributors and users expanded, our geographical diversity deepened, and our effect on increasing openness, participation, innovation and individual empowerment in Internet life is significant. Here are some examples.

In February we launched Mozilla Messaging to develop Mozilla Thunderbird as well as new possibilities in the broader messaging arena. 2008 was primarily a start-up year for Mozilla Messaging. In 2009 we’re starting to see the Mozilla Messaging team deliver on the promise. The final version of Thunderbird 3 –- a vastly improved product — is due to be released shortly. In addition the initial developer version of Raindrop — a prototype for a new way of integrating different kinds of messages — has been released.

In 2008 we developed a set of two-year goals (the “2010 goals”), setting out major areas we’d like to see the Mozilla project address in 2009 and 2010. The 2010 goals build upon the Mozilla Manifesto, which articulates the values underlying the Mozilla project and our products. Two of these are familiar — openness in general and continued vitality of Firefox. Two are newer: the mobile web and helping people manage the explosion of data around us. These reflect our desire to see the values of the Mozilla Manifesto infused into these areas of Internet life.

We began an on-going process of strengthening some of the Mozilla project’s basic assets. We began broadening our “module ownership” system beyond code to include governance activities. We began a long-overdue update of the mozilla.org website. In September Mark Surman joined as the new Executive Director of the Mozilla Foundation. These activities continued in 2009, along with new Education and Drumbeat programs.

We expanded the scope of our innovation efforts under the “Mozilla Labs” banner. We launched a range of projects including our first Design Challenge, Test Pilot (user testing program), Ubiquity (natural language interface to browser interaction), and a Developer Tools program. We also expanded existing projects like Weave, Personas and Prism. This focus on innovation continues during 2009.

The activities of Mozilla’s support, localization, campus representative and design communities expanded significantly through 2008 and 2009, reaching more people in more ways.

Mozilla continues to grow ever more global. In June 2008 Firefox 3.0 launched simultaneously in 46 languages. A year later, Firefox 3.5 featured 70 languages. In 2008 Firefox became the majority browser in specific countries. This started with Indonesia, which passed 50% in July 2008, and grew to include Slovenia and Macedonia by the end of 2008. Since then, Slovakia, the Philippines, Poland, Hungary, Latvia, Bosnia Herzegovina, and Ghana have joined this group. Our local communities also work with other Mozilla products and activities such as Thunderbird, Seamonkey and Service Week (in 2009).

We intend to continue to invest significantly in global participation.

Product and Competition

The number of people using Mozilla products increased dramatically throughout 2008 and 2009. This user base makes Mozilla relevant to the Internet industry, helping us move the Internet to a more open and participatory environment. It also helps us build public benefit, civic and social value as components of the Internet’s future.

The number of people using Firefox on a daily basis increased from 28 million in 2006 to 49 million in 2007. In 2008 we moved up to 75 million daily users. As of November 2009 the daily number has grown to 110 million, bringing the total number of users to approximately 330 million people.

Our market share rose to approximately 21.69% in December of 2008. This breaks out into U.S. market share of approximately 20.2%, and more than 32% in Europe. Our statistics for Asia are similar, with our own estimates around 20%. Our South American market share rose to 27% by the end of 2008. These numbers have all continued to rise in 2009 as well. In February, 2008 we crossed the half-billion download mark; in July, 2009 we exceeded 1 billion downloads. As of November, 2009 Firefox’s market share worldwide reached 25%.

In June 2008 we released Firefox 3.0, bringing dramatic improvements to the online browsing experience. These improvements included features to help users quickly navigate to favorite websites, manage their downloads more easily, and keep themselves safe from malware attacks. Firefox 3 was downloaded over 8 million times in the first 24 hours, earning Mozilla a Guinness World Record. In June 2009 we released Firefox 3.5, with additional performance and feature improvements. In November 2009 we celebrated the fifth anniversary of Firefox.

Work on Firefox for mobile devices began in earnest in 2008 with the first development milestones released. We expect to release the first product versions late in 2009. The mobile market has many challenges for us, in particular the fragmentation of the development platform (a plethora of operating systems, handsets and carriers) and a market where touching a consumer directly is more difficult. However, the market is beginning to change and a great, open browser will both help that process and benefit from it. We have much more to do, but have laid a good foundation for long-term contribution to the mobile Web.

SeaMonkey remains a vital project with millions of users. Bugzilla continues as a backbone tool for numerous organizations. A revitalized Thunderbird 3 should ship in 2009.

Looking Forward

The past few years have seen an explosion of innovation and competition in web browsers, demonstrating their critical importance to the Internet experience and marking the success of our mission. In 2008 not only did Microsoft and Apple continue developing their web browsing products, but Google announced and released a web browser of its own. Competition, while uncomfortable, has benefited Mozilla, pushing us to work harder. Mozilla and Firefox continue to prosper, and to reflect our core values. We expect these competitive trends to continue, benefiting the entire Web.

The Internet remains an immense engine of social, civic and economic value. The potential is enormous. There is still an enormous amount to be done to build openness, participation and individual opportunity into the developing structure of the Internet.

Hundreds of millions of people today trust Mozilla to do this. This is an accomplishment many thought was impossible. We should be proud. We should also be energized to do more and to try to new things. It’s a big challenge. It’s important.

We’ve made this opportunity real. Let’s go surprise people once again by showing how much better we can make the Internet experience.

Henrik GemalFirefox on Playstation 3?

There's a rumor out that Sony is looking into bringing Firefox to the PS3 platform:

"We recently received a tip from a source very close to Sony who says that they have been in talks with Mozilla lately about possibly porting firefox over to the PS3. That said, our source made sure to point out that they were unsure if any deal had actually been reached at this point, but it is great news none the less considering the complaints Sony has been getting about the lack of reliability with their current built in PS3 web browser."

Read more

Daniel GlazmanConférence à l'INRIA Sophia-Antipolis

Je serai le 25 novembre au matin à l'INRIA Sophia-Antipolis pour donner une conférence d'une heure intitulée "Browser War 2009". Seront également présents avec moi des employés du W3C dont Bert Bos (co-inventeur des CSS, ancien chairman du CSS WG, Style Activity Lead au W3C et actuel W3C Staff Contact du CSS WG) et probablement d'autres. Si vous êtes intéressé par l'état de l'art des standards du Web, que vous voulez voir quelques démos assez bluffantes du futur que les navigateurs Web nous préparent, ou si vous avez envie de vous renseigner sur le W3C et savoir pourquoi vous devriez rejoindre le World Wide Web Consortium, l'entrée est gratuite (dans la limite des places disponibles évidemment...). Nota bene important : la conférence sera donnée en français, comme le tite l'indique bien ;-)

A mercredi !

Jonathan DiCarloSunlight Foundation Hackathon


The Sunlight Foundation is a nonpartisan organization dedicated to making information about our government’s shenanigans more easily accessible, for the sake of transparency and accountability and all that good stuff. They do great stuff like document all the connections between the pharmaceutical lobby and the members of congress working on health care reform.

They’re having a hackathon Dec 12-13. Mozilla is going to be holding one of the events. I’m going to do a project for it.

But what? I’ve got several vague ideas, but I don’t know for sure what I’m doing yet. Some kind of interactive mash-up or data visualization or cool map based on publicly available governmental info; something that makes a strong point with data and that hasn’t been done before.

One idea that I’d love to see made into reality is that of a “revision control history” for bills and laws. This one that was done for the stimulus bill was cool, but it was a one-off; I would love to see a generalized solution that would automatically update, track all bills, allow search and browsing via the web, and would have an API allowing it to be used as a building-block for further mash-ups. I know I’m not the only one who wants this. I need to do some research into what the state of the art is in this area and what obstacles exist to taking it further.

I’m also looking for other suggestions for projects, so let me know if you can think of any correlation/visualization you’d particularly like to see!

(P.S. this is not an invitation to turn the comment thread into a political flame war. Thanks.)

Alan StarrRandom Thought on GPS navigation using your phone

Ok, so one of the downsides about using your mobile phone for driving directions is that it can't have a comprehensive set of maps stored like a regular GPS unit would. How about some sort of external hard drive you can hook into? It would like you have extra movies, map data, whatever. That way you can pre-load a lot at home before you get on the road.

Personally, I'd want to be able to use my phone to download over Wi-Fi, but I have no desire to pay to download over the EDGE/3G/4G network.

Mozilla Add-ons BlogJetpack for Learning

Help turn the open Web into a rich learning environment and explore new possibilities for using Firefox add-ons to support learning online, as part of the the Jetpack for Learning Design Challenge sponsored by the Mozilla Foundation with support from the MacArthur Foundation.

Designers, educators and software developers who want to turn their innovative ideas into working prototypes will learn to use the new Jetpack technology from Mozilla Labs to create Firefox add-ons to support learning on the open Web, using standard web technologies like HTML, CSS, and JavaScript.

The creators of the most promising add-ons will be invited to an intensive three-day Jetpack for Learning Design Camp (to be held in conjunction with SXSW Interactive in March 2010), where they’ll further refine their work and the best add-ons will be publicly recognized.

Learn more at the Jetpack for Learning website.

ShareThis

Firefox Support BlogHelp the Firefox team

There are a few bugs that the Firefox team is asking for help with. If you’re experiencing any of these bugs or are helping users with these bugs on SUMO, they’d love to get in contact so we can get more information or try workarounds.

  • Crashes with the @_woutput_l signature that have FFTMUFEHelper.dll in the crash stack or the module list. These are probably the TrendMicro Toolbar. We’d like some specific information about the users’ TrendMicro install and put them in touch with TrendMicro so they can figure out what’s causing the crashes. See bug 511756.
  • Crashes for users in Turkey. If any users would like to help in debugging these crashes (the current thinking is they’re related to DNS servers in Turkey, please have them post in bug 508292.
  • Lost or missing downloads. We saw a few reports of downloads in Firefox being deleted as soon as they finished downloading. Now we’re looking for more information. This is most likely do to some kind of security software — we’re just not sure which. Try to get the users’ antivirus software, version and if they’re still getting updates. Please comment in the Contributors’ forum if you find out anything.
  • Firefox closes/quits (no Crash reporter) when closing AOL mail windows. We’re looking in particular for steps to reproduce and also their Firefox version and window/tab settings. Again post in the Contributors’ forum or pass along any contact information. Bug 515679 has more information.
  • Firefox 3.6 has two changes just pushed in beta 3 that affect some users: 1) Third party software in the components directory of the install folder will need to register itself 2) Users who tweaked a preference to disable extension compatibility checking in Firefox will find that it now needs to be set for every version of Firefox. If you come across legitimate software that is using the components install pathway or websites giving the old compatibility checking advice for 3.6 please let us know in this Contributors’ forum thread.

Getting help on these bugs would go a long way towards improving Firefox and fixing issues. If you’re passing along information from a Firefox user who comes to support, please make sure that you ask their permission and be sure to convey along our thanks for all their help.

Daniel GlazmanOpera widgets without Opera...

Take an arbitrary Opera widget like this one. Have a xulrunner package (to be launched by Firefox 3) to handle it. And here's the result, on my Mac OS X desktop:

Gecko running Opera widgets.

I'll release the code as soon as I can.

DelphineWoMoz Update

Quick update about the Women & Mozilla project:

  • 1rst official meeting today on the Mozillawomen IRC channel, at 18:00 UTC. Topics:
    • Work on survey: Why so few women in open source? Do they leave or not join in the first place?
    • Discuss about what women find that's been difficult when they join Mozilla (this can be stretched to FLOSS and more in general to non-Mozilla contributors). And what things have been helpful?
    • Discuss how to get organized: who wants to do what?
    • Quickly discuss bugzilla/dev ml idea
    • What's next? (our priorities concerning the next actions we should undertake)
  • Upcoming actions:
    • Bugzilla or dedicated mailing list for issues concerning the WoMoz Website redesign / content / organization / etc.
    • Written and video tutorials online
    • Organize our existing tools
    • Collaboration between MIAGE women students of Évry University (France) and interested WoMoz contributors to work on improving / developing WoMoz Website and project.
    • Evangelist team + mentoring program: contributors can help curious people in their first contribution
    • Visit our Actions page and our TODO list to stay tuned with our current actions

Marco ZeheThunderbird 3 is coming out soon, and it’s accessible!

The release of Thunderbird 3 is just around the corner. Aside from all the great new features Thunderbird 3 has in general, its accessibility story is also one which should be celebrated once the release has happened.

Thunderbird 3 is based on the Gecko 1.9.1 platform, which is the same version that Firefox 3.5 is based on. As such, Thunderbird 3 has learned all the great new features of the platform, many of which have a significant impact on users with disabilities. Please allow me to highlight the major improvements and new features.

Support for new accessibility APIs

Thunderbird 3 supports the IAccessible2 standard on Windows. IAccessible2 is a major enhancement to Microsoft Active Accessibility (MSAA), which allows assistive technologies to directly interact with the rich content an HTML e-mail message can have, through a defined set of APIs. Screen readers for the blind, for example, no longer need to rely on old-school screen-scraping methods to try and guess what the application is showing. Instead, headings, block quotes (such as in quoted messages) etc. are all identifiable without question. Font and styling information is available as well. NVDA 2009.1, Window-Eyes 7.1 and JAWS 10 and above take advantage of these technologies already and offer a hugely improved experience for their user bases over what Thunderbird 2.0 had to offer.

This also includes support for in-line spell checking. If enabled, screen readers can identify misspelled words just like in Firefox, and users can go and correct their mistakes on the fly without having to invoke the extra spell checking dialog.

Accessibility on the GNOME Desktop

Thunderbird 3 is accessible to Orca users on the GNOME desktop in Linux. While Thunderbird 2 offered close to no accessibility support, Thunderbird 3 offers a wide range of accessibility to visually impaired users.

Also, the support for ATK/AT-SPI allows other assistive technologies such as GOK (GNOME On-screen Keyboard) to interface with Thunderbird and allow the use by people with motor impairments.

Tabbable and properly labelled message headers

When reading messages, most of the header fields of a message are now reachable via the tab key. This is a huge improvement for any keyboard user. Access includes the “star” that allows to quickly add a contact to the address book or to edit a previously added contact.

All these fields and controls also have proper accessibility labels so that screen reader users immediately know what they’re interacting with.

One known problem is that the multi-functional “reply” control currently isn’t part of the tab order.

Better support when composing messages

Aside from the above mentioned API improvements, the UI also received some love to better communicate the happenings when filling out the from:, to: etc. fields while composing a message. Selecting a different field type now also does not throw newer versions of screen readers into limbo or confused states any longer. Working with the Contacts side bar is also supported.

Over-all UI improvements

Over-all, the various dialogs in Thunderbird such as Tools/Options, Tools/Account Settings and others have received a major accessibility overhaul esp with regards to properly labeling textboxes, radio groups and other XUL widgets so screen reader users get accurate information while tabbing through. Infact, a Thunderbird XUL UI fix was my very first patch when I started contributing to Mozilla. :)

New UI features were also made accessible

New UI features such as the all-new facetted search were also made largely accessible. The new Search, for example, makes heavy use of WAI-ARIA to allow both an appearance that’s visually appealing and keyboard and assistive technology communication that’s accessible. The one exception in this new piece of the product is the graph that shows the search results over time. This is based on SVG, which is totally inaccessible at the moment.

A call-out to Thunderbird extension developers

With the above improvements now being in place, it is equally important for Thunderbird extension developers to follow these simple rules to make their extensions accessible, as it is for developers of extensions for Firefox. DOM Inspector offers an accessibility view which allows you to check whether your XUL has proper labels for textboxes and other good markup! Also, don’t be shy to ask questions! The accessibility team hangs out on the #accessibility channel on irc.mozilla.org and will be happy to assist!

A few known problems remain

As always, nothing can be perfect, but we’re striving to be as perfect as possible. Having said that, there are a few issues that remain, but for which fixes are already visible on the horizon:

  • When viewing messages as threads, the fact whether a thread is expanded or collapsed is not yet communicated to screen readers. This will be different once a new version of Thunderbird switches to using Gecko 1.9.2 or later, which includes the all-new tables support.
  • The same is true for the “subscribe” dialog for newsgroups and IMAP folders. Right now, screen readers do not yet get the state whether a certain folder is checked or not. This will also change with a switch to the new Gecko platform.
  • Folders in the folder pane cannot be navigated to using first-letter navigation. I’m hoping we’ll find a solution to this often voiced request in the future.
  • The picker for rearranging the columns in the message list isn’t accessible via the keyboard yet. You can use the mouse emulation of your screen reader to get to that button to the right of the column headers to access options.

Thanks!

I’d like to thank everyone who has been writing to me over the past two years pointing out Thunderbird accessibility issues. As was expected, these actually made up a higher volume than Firefox since there were more UI-related issues. Keep the feedback coming!

I’d also like to extend a huge thank you to the team at Mozilla Messaging and the voluntary contributors who all helped with implementations, reviews, suggestions and advice while improvements for Thunderbird 3 were requested, triaged and acted upon. I really feel that accessibility is being taken seriously, and I honestly hope that a lot of users worldwide will show their appreciation by downloading and using Thunderbird 3 when it comes out! I’ve been using it for over 2 years now while it was being developed and haven’t regretted making the switch!

Keep up the good work!

Boris ZbarskyLinux (FC12) wake-on-LAN woes

I just spent the last two hours or so trying to get wake-on-lan to actually work on Linux. Sadly, most of the HOWTOs (assuming the link isn't broken) aren't actually that useful. Here's what I can observe

  1. Wake-on-LAN is enabled in the BIOS.
  2. Shutting down with "poweroff" or "shutdown -h" leaves the network card powered (the link light is on).
  3. Sending a magic packet to the machine doesn't power it on.
  4. If I hit the small black button on the back of the power supply once, it makes a slight noise, and after that sending a magic packet does power on the machine.

So my best guess so far is that poweroff puts the power supply into a state from which the NIC can't wake it up. I have no idea what that state might be, nor how to change this behavior. I welcome any ideas!

Update: To be clear, I've tried all the power management setting combinations in the BIOS. Most have the behavior I describe above; the rest power down the network card as well.

Update: To forestall more comments from people who aren't reading item 4 above carefully, the network card itself reports that it'll do wake on magic packet when you ask with ethtool. It DOES do wake on magic packet, in fact, but only after I press that button on the power supply. And honestly, try to give me some credit for actually trying the one thing all the howtos on this have in common, that being ethtool.

Shawn WilsherInstalling Raindrop on Dreamhost

It turns out that installing Raindrop is really hard. Here’s what I didtried to get it running on Dreamhost. Hope it helps anyone else who wants to play around with it, and I hope they can get further than I did.

Directory structure

In my home directory, I created a new folder called opt.
mkdir opt
You’ll also want to add the following lines to your .bashrc file:
export CFLAGS="-I$HOME/opt/include -L$HOME/opt/lib $CFLAGS"
export CXXFLAGS="-I$HOME/opt/include -L$HOME/opt/lib $CXXFLAGS"

I also created a sources directory, where I’ll be putting all of my source files in.
mkdir sources
We’ll want to be in the sources directory as we install everything.
cd sources

Installation Fun

Install python

wget http://www.python.org/ftp/python/2.6.4/Python-2.6.4.tgz
tar xvfz Python-2.6.4.tgz
cd Python-2.6.4
./configure --prefix=/home/sdwilsh/opt/
make
make install

Install OpenSSL

After you get the source from a mirror and untar it, enter that directory, and run these commands:
./config --prefix=/home/sdwilsh/opt --openssldir=/home/sdwilsh/opt/openssl shared
make
make install

Install Erlang

Note: I had to bump my memory on my PS up to 304 MB (from 150 MB) in order for this to compile. I just doubled it, so you may be able to get by with less. This also takes a while to install.
wget http://erlang.org/download/otp_src_R13B02-1.tar.gz
tar xvfz otp_src_R13B02-1.tar.gz
cd otp_src_R13B02-1
./configure --prefix=/home/sdwilsh/opt/ --with-ssl=/home/sdwilsh/opt/
make
make install

Install ICU

wget http://download.icu-project.org/files/icu4c/4.2.1/icu4c-4_2_1-src.tgz
tar xvfz icu4c-4_2_1-src.tgz
cd icu/
chmod +x runConfigureICU configure install-sh
./runConfigureICU Linux --prefix=/home/sdwilsh/opt
make
make check
make install

Install autoconf-2.13

wget http://ftp.gnu.org/gnu/autoconf/autoconf-2.13.tar.gz
tar xvfz autoconf-2.13.tar.gz
./configure --prefix=/home/sdwilsh/opt/
make
make install

Install Spidermonkey

Note: You many need to install Mercurial. I used easy_install to do.
hg clone http://hg.mozilla.org/releases/mozilla-1.9.2/
cd mozilla-1.9.2/
hg update -r FIREFOX_3_6b3_RELEASE
cd js/src/
autoconf
mkdir build-release
cd build-release
../configure --prefix=/home/sdwilsh/opt/
make
make install

Install libssh2

wget http://www.libssh2.org/download/libssh2-1.2.2.tar.gz
tar xvfz libssh2-1.2.2.tar.gz
cd libssh2-1.2.2
./configure --prefix=/home/sdwilsh/opt/ --with-openssl
make
make install

Install curl

After you get the source from a mirror and untar it, enter that directory, and run these commands:
cd curl-7.19.7
./configure --prefix=/home/sdwilsh/opt/ --with-libssh2=/home/sdwilsh/opt --with-ssl=/home/sdwilsh/opt
make
make install

Install couchdb

After you get the source from a mirror and untar it, enter that directory, and run these commands:
./configure --prefix=/home/sdwilsh/opt/ --with-erlang=/home/sdwilsh/sources/otp_src_R13B02-1/include --with-js-include=/home/sdwilsh/opt/include --with-js-lib=/home/sdwilsh/opt/lib --with-erlang=/home/sdwilsh/opt/lib/erlang/usr/include
make
make install

Note: I feel like I may have messed up how I installed erlang given the strange place it put its header files, but I wasn’t about to recompile it.

Change Permissions & Run

CouchDB suggests you create a new user for to run it is, but this is hard to do it seems, so I skipped it. I did change the permissions, however.
chmod -R 0770 /home/sdwilsh/opt/etc/couchdb
chmod -R 0770 /home/sdwilsh/opt/var/lib/couchdb
chmod -R 0770 /home/sdwilsh/opt/var/log/couchdb
chmod -R 0770 /home/sdwilsh/opt/var/run/couchdb

And now to run CouchDB:
couchdb -b
Sadly, this was taking something close to 500MB of memory. This is far to high for my server to sustain, so I haven’t gotten any further. If anyone has any ideas, I’d be glad to hear them.

Firebug BlogFirebug 1.5b4

getfirebug.com has Firebug 1.5X.0b4. It passes all of our tests on Firefox 3.5 and 3.6b4pre. Two case fail on FF 3.7; one is a changed error message, one looks like a change in Firefox. (We’re only aiming for 3.5 and 3.6 for now).

Next we aim to improve the quality by identifying important bugs from among those that have test cases and tagging them with with “blocks1.5“. If you have a favorite bug, we welcome your input on what gets fixed before we decide Firebug 1.5 is done.

We are also reaching out to Firebug extension authors to update for 1.5. We already have some progress, with updated versions of FirePHP, Rainbow, FireQuery, and FireLogger.

This release is dedicated to Steve Roussey for his contributions to the HTML panel editing and entity display. A lot of the closed issues below came from his work.

Changes since 1.5b3:

  • New locale hr-HR/Croatia
  • Update locales ro-RO, es-AR, is-IS, sl-SI, js-SP
  • Issue 2464: Network panel showing total size of requests as 0 KB
  • Issue 2471: appShellService.hiddenWindow causing problems embedded in an SWT Browser
  • Issue 674: long variable contents are cut off in tooltips
  • Issue 2467: timeline bars don’t show
  • Issue 2374: Firebug not work in SeaMonkey 2.0rc1
  • Issue 2448: Firebug HTML panel encoding display and editing
  • Issue 2481: ‘Add watch’ on 2nd expression of a multi-conditional will use incorrect expression
  • Issue 2454: Light up the tab whenever break on next is selected
  • Issue 1466: Changing any User Agent CSS makes firefox go grazy and after a while crash
  • Issue 2285: support for content-type: multipart/x-mixed-replace
  • Issue 1440: Net tab is showing XHR logs with size of “?”
  • Issue 2489: When inspecting in an iframe, you can’t see any parent frames
  • Issue 2067: Open in a new Window fails with tab switching once Firebug is minimized
  • Issue 838: HTML specialchars not shown correctly
  • Issue 1138: nbsp elements rendered in the DOM as spaces
  • Issue 1488: Uninformative message when command line fails while NoScript enabled
  • Issue 1980: < > does not get encoded while editing element content
  • Issue 2250: Firebug generates invalid (X)HTML for displaying empty elements in the HTML panel
  • Issue 2359: Zero-width spaces (ZWSP) HTML characters are not displayed in the HTML tab
  • Issue 2435: Show whitespace on text nodes that have sibling element nodes displays ? instead of text
  • Issue 2438: Show Full Text option only works on text node that does not have a sibling element
  • Issue 2439: Editing a text node with whitespace and the option Show White Space gives wrong result
  • Issue 2453: When MathML nodes are edited the rendered MathML is not updated
  • Issue 2470: HTML panel does not show namespaces
  • Issue 1414: “Copy HTML” feature does not respect explicit end tags in XHTML

jjb

Please post followups to the newsgroup

Mozilla LabsWeave Web UI Design Challenge

Design Challenge Logo

In early September we invited the wider community to develop concepts for the question “Visualizing your browser data – How can we provide intuitive and useful visual representations of your browser data (such as bookmarks, history, tabs, stored credentials etc.) on a web page?”

A total of 17 solutions were submitted in the first phase of the Design Challenge and analyzed by the Weave team. After an long round of discussion and carefully going through all submissions, the Weave team decided to return to the drawing board and better clarify the experiences Weave wants to enable, instead of moving this challenge to the second phase. The submissions significantly helped the team to identify potential interaction models and design directions.

The submitted concepts were (in order of submission date):
Luciano Lobato, Sridutt YS, David Little, Eshed Zachevsky, Shubham Sinha, Ely S, Silvio Fachinotti, Anil Chaudhry, Miyoung Yoon, Vijaya Ramanujam, J Newengland, Brennan Moore, Murray Thompson, Scott Fitchet, Maureen Hanratty, a mal.

You can view all entries with short explanations of the respective concept on the ChallengePost website.

Mike PinkertonCamino 2.0 Released!

I am very proud to announce today's release of Camino 2.0, available for download from our website. This release represents the culmination of over a year of hard work by our developers, testers, and localizers and easily surpasses the high quality bar we have set in past releases.

I want to stress that this is a product of our community, including our users, who provided valuable bug reports and feedback along the way. I am constantly impressed with the community's enthusiasm for the project and the care and thought put into every feature. They should be proud of this product and their contributions to it. I think it says a lot about the community that an open source project can have such high quality and attention to detail. Remember, none of these folks are getting paid. This is solely a labor of love.

I won't spend a lot of time listing features, since you can easily see them on the website, but many of the changes are under the hood. We're using a much more up to date version of Gecko (though not the latest for various reasons), and that will improve web page rendering and compatibility significantly from previous versions. If you find no other reason to upgrade, do it for the new Gecko.

Give it a spin, I'm sure you'll enjoy it!

Smokey Ardisson☢ alert

If you’re reading this, it means that yet another major version of Camino is now in the wild. Today we released Camino 2 (codenamed ☢, because our first choice of “kittens” didn’t have a Unicode glyph) after over a year in development. There are a number of major architectural changes under the hood that should make your overall browsing experience much better, and on top of that we’ve added a number of exciting new features. It has, once again, been a long(er-than-expected) journey, but we’re very proud of all the work we’ve put into Camino 2 and are pleased to offer you a new stable release.

The road to Camino 2 began in April of 2008 when we wrapped up work on Camino 1.6, although we had been performing architectural maintenance and related work to keep up with Gecko 1.9 changes since late 2007 (and some of the changes in Gecko itself were made all the way back in 2005, after the MOZILLA_1_8_BRANCH was cut on August 12, 2005). Over the last year and a half, we’ve fixed more than 450 “bugs” (problems or new features), and 16 different people contributed patches for this release (Stuart Morgan again led the way with 119 fixes). Sean Murphy implemented three major features this release (tab dragging, phishing and malware protection, and rewritten Full Keyboard Access support in the browser window), and Christopher Henderson and Ilya Sherman showed up to implement full content zoom and Growl notifications for downloads, respectively, and stuck around to fix over four dozen other bugs between them. Big thanks also to the one-third of that list of patch contributors who aren’t regular Camino developers; every little fix helps make Camino a better browser.

In some ways Camino 2 isn’t the revolutionary release we hoped it would be when we wrapped up Camino 1.6, but it’s still a vast improvement over Camino 1.6 and a triumph for an all-volunteer, all-free-time development team in today’s world of corporate-sponsored browsers.

Thanks to our hard-working localization teams, Camino 2 is available today in US English and 13 other languages, with Polish expected to join that list as soon as our Polish localizer’s Mac is repaired. Sadly, we had a few languages that shipped in Camino 1.6 disappear on us, so if your language is missing, please stop by the caminol10n mailing list and see how you can help bring these localizations back. (As I mentioned earlier this year, the work doesn’t require much specialized computer/software knowledge; you and a friend can bring Camino to thousands of users in your language! For Camino 2, new contributors successfully revived the Danish localization, which was in Camino 1.0 but disappeared from Camino 1.5.)

This year I again went to bed the night before release while fearless webmaster Samuel Sidler stayed up putting the finishing touches on the home page, the Features page, and implementing the new website design from the folks at Clearleft. One of these years both Sam and I are going to get a full night’s sleep before a major release, but this was not to be that year. Aside from a few things here and there, it seems like the website and webserver bits went more smoothly this release than with 1.6.

What’s next? Those of us who have been working on the website and release details for the past month or so are going to take a little rest. Parts of the development team, which wrapped up development with a late-October push, are already starting to work on new features for Camino 2.1. Nightly builds already include Dan Weber’s 2009 Summer of Code work on location bar autocomplete, and we have some early plans for other features in Camino 2.1 (we’re always looking for contributors, so if you’re interested in helping make a great Mac browser, stop by the Contribute page or find us on irc).

In the meantime, enjoy Camino 2.0 and let us know what you think!

November 18, 2009

Dietrich AyalaEasing Orange: Jetpack for Correlating Tinderbox Test Failures with Bugs


This is a Jetpack feature for finding out if a bug is already filed for a test failure on Tinderbox. When viewing log files for failed test runs, the Jetpack will add a link next to the test failure summary at the top of the log, that looks like “(maybe bug XXXXXX?)”. This allows sheriff’s and other awesome community members to easily mark known-oranges, and update the bug with log’s URL.

Install the Jetpack feature.

Notes:

  • So far it only pulls file names out of error text, so won’t match leaks, crashes or oranges without a filename in the summary.
  • Only searches the bug summary, and only searches known orange bugs (ie: has “[orange]” in the bug whiteboard).
  • Scrapes bugzilla.mozilla.org, since the new REST api is very very slow, so might break with bugzilla upgrades.
  • It doesn’t run until the log has completed loading, which sometimes can be a while. Load that shit in a background tab and be patient yo.

Let me know if this helps you out, or any bugs or improvements you’d like to see!

Camino BlogCamino 2.0 Released!

After over a year of hard work, the Camino Project is proud announce Camino 2.0, a major new update to the Camino web browser.

Camino 2.0 includes a number of new features and enhancements, including rearranging tabs by drag-and-drop, a new Tab Overview feature, phishing and malware protection, full content zoom, Growl notifications for downloads, improved support for Full Keyboard Access in the browser window, and displays web content using Mozilla’s Gecko 1.9 rendering engine. For a list of features in Camino, visit our features page. Also, see the release notes for more detailed information about changes in Camino 2.0.

Camino 2.0 is available today in 14 languages:

  • Chinese (Simplified)
  • Danish
  • Dutch
  • English (US)
  • French
  • German
  • Italian
  • Japanese
  • Norwegian (Bokmål)
  • Russian
  • Slovenian
  • Spanish (Castellano)
  • Swedish
  • Turkish

One other language, Polish, is expected to be available in the near future.

As always, you can download Camino 2.0 in English (or the multilingual version) from our website, and existing Camino users will receive this release via software update. Camino 2.0 is available for users of Mac OS X 10.4 or later.

Henrik SkupinAutomated Software Update tests with Mozmill

Release testing which has to be done by QA right before a new release of Firefox will be offered to our users is still an area where lot of manual work is involved. That means we run Smoketests and the Basic Functional Tests (BFT’s) against the build candidate. As I have already written there is ongoing work with Mozmill to get those work fully automated in the future. But that are not the only tests we have to run…

Since ever Firefox is supporting automatic updates we also have to check that each and every user will get the right update package for the installed version of Firefox. Most of our users should run the latest version of Firefox but there are also cases where people don’t update immediately or even don’t want to upgrade to the next major version of Firefox. Given that updates have to be delivered to each of the supported branches (e.g. Firefox 3.0.0.x and Firefox 3.5.x) and also as major update for upgrading to the next major version. We also have a community beta program running where users can help testing beta versions of the next Firefox version. Those users will get a separate update offer on another update channel.

Finally there are 4 different channels we have to test for en-US and some of our P1 localized builds. In detail those are in the right order:

  • betatest: This channel makes sure that updates which will be delivered to beta users will pass.
  • beta: Beta testers will get their updates on that channel.
  • releasetest: This channel tests the update snippets which have been pushed to our official download mirrors.
  • release: Default channel for all Firefox installations to get the next version.

For each of those mentioned channels we offer partial and complete updates. The former one will be used if the latest minor version of Firefox is in use, e.g. a user wants to update from 3.5.4 to 3.5.5, while the latter one is for all other versions of the same branch. If an update fails to apply which could happen due to different reasons like a download problem, users will not get stuck on their installed version. In such a case a fallback update will be downloaded which is identical to the complete update. If that fails too the same process will be started again after a given time.

Until now these tests had to be done manually by us. An example can be seen in the update section of the Firefox 3.5.5 test plan. So we normally tests updates on all supported platforms, for each update type (minor, major), and make sure that fallback updates will pass.

With the new software update tests for Mozmill which I have finished two days ago, we can easily automate this process now. The only manual steps which have to be done is to prepare the tests by downloading the necessary builds for all the platforms and place them in their own folders. Once that is done the automated test can be started. It will use all builds within a given folder and runs tests updates for the specified channel. The results are printed in wiki format to the console and only have to be copied to the appropriate Wiki page.

If you are interested in running those update tests you have to install Mozmill on your machine and clone our Mozmill test repository. Detailed steps can be found in the Mozmill test creation tutorial on QMO.

This is a big step forward in a direction where we can run update checks against each localized build of Firefox and can make sure that updates are successfully applied and don’t fail or cause any sort of failure. And it will give QA more time to focus on other topics.

If you are interested and want to know more about Mozmill then join us in #QA on IRC or subscribe to the Mozmill developer list.

Armen Zambrano GasparnianCheck for add-ons compatibility changes

I had my check for add-ons compatibility disabled but it recently stopped working.

To fix this instead of using this:
extensions.checkCompatibility;false
you can use this:
extensions.checkCompatibility.3.6b;false

As always, do not use this for stable releases as a workaround because one of your add-ons has not yet been updated after a new release. Doing so might make your new Firefox not to work as expected.




Creative Commons License
This work by Zambrano Gasparnian, Armen is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Ray KiddyThree Pictures

What do these three pictures have in common?







The first is a US Dept of Homeland Security warning. The second is a Proposition 65 warning from California. The third is from Firefox when we add _any_ add-on.

Obvious questions are:
- does anyone feel safer when they see these?
- do these actually inform one of anything?
- why are these being displayed? for whose benefit?

Firefox Support BlogUpdating the knowledge base for Firefox 3.6 – The Plan

Over the past month, the SUMO community has gathered a list of changes in Firefox 3.6 and determined which knowledge base articles need to be updated. We have been in contact with localizers and KB contributors to establish the update plan, and here it is:

The English update – this week

  • All updates to English articles will be done manually. If you would like to help, just pick a section in the Mozilla wiki page, and update the articles listed in it.
    • We will not be displaying Firefox 3.5 and 3.6 content separately (i.e. using SHOWFOR).
    • We will be using the “Mark other translations as out of date” checkbox when approving edits for 3.6. This will make the articles appear in the “Needs Updating” section of the Localization Dashboard, so localizers will know which translations are ready to be updated.
    • For screenshots, use Firefox 3.6 Beta 3.
  • We will also be creating a new article that walks users through the information they see in the new Troubleshooting Information page (a.k.a. about:support). (bug 528112)

Localization – now until release

A good way to get started, is to go through the list of articles that mention the “Main panel“, and change them to General panel (Main panel in Firefox 3.5)”. If you have any questions, just ask in the Contributors forum thread. Thank you!

Mozilla Web DevelopmentAMO Changes for 2010

Yesterday Wil Clouser wrote up a blog post detailing infrastructure changes for addons.mozilla.org in 2010.

Notable changes are:

  • Migrating from CakePHP to Django
  • Moving from SVN to Git
  • Continuous integration
  • Faster deployment
  • Processing data offline
  • Improved documentation

Take a look, it’s a good overview of the technical challenges of managing a large and complex website at an enormous scale.

Mozilla LabsPersonas: 10 Million and Growing

The Personas movement continues to grow with over 10 million people choosing to personalize their Firefox.

amo

Read more here!

- Suneel Gupta & Myk Melez on behalf of the Personas development team

Mozilla LabsPersonas: 10 Million and Growing

The Personas movement continues to grow with over 10 million people choosing to personalize their Firefox.

amo

What Has Changed?

Since Personas was launched earlier this year, over 10 million people around the globe have chosen to personalize their Firefox by downloading Personas. Here is a quick look at what else has happened since the launch:

  • Nearly 35,000 designs were contributed from artists at all levels of experience from all parts of the world (over 1,000 designs / week).
  • Over 450 community members have shared ideas and feedback on the Personas forum.
  • Nearly 40 affinity brands, including Harry Potter, Bob Marley, Lady Gaga, and Greenpeace have added their content to the gallery.
  • Using community feedback, the Personas development team has released 13 upgrades (4 add-on, 9 website releases) in order to add features like Favorites.
  • Localization community has diligently translated the add-on into over 25 languages; Personas website will be localized by the end of the year.

Thanks!

Like all Mozilla projects, Personas is a collaboration between people who develop the product and people who use it. The following people (and many more) have been commited to this product’s success:

  • NinaBella, Digital Blasphemy, MaDonna, and thousands of other artists around the globe that give millions of Firefox browsers a personalized look and feel. They are the heroes of this project.
  • Shae Rivard, who has supported the resolution of over 200 issues on the Personas discussion forum, as well as over 450 other members, whose feedback, testing, and contributions continuously make the product better.
  • Ryan Doherty, Myk Melez, Toby Elliot, and Zandr Milewski, with the support of Erik van Eykelen, and Jose Bolanos, for collaborating with community feedback to constantly improve on the product. Collaboratively, the development team has fixed over 300 issues since launch.
  • Carsten Book (a.k.a. Tomcat), Stephen Donner, Tony Chung, Krupa Raj, and Vishal Kamdar, for assuring quality releases, and for doing so within incredibly tight deadlines.
  • Amy Zehren, Sean Martell, Catherine Brady, and Julie Martin, with the support of Monique Johnson, who have reached out to countless brands around the globe to share the Mozilla story, and offer them the opportunity to participate in a growing movement.
  • Tara Shahian, Mary Colvig, Melissa Shapiro, John Slater, Sarah Doherty, Jay Patel, and all the other members of the marketing community that helped build awareness around Personas.
  • Seth Bindernagel, Staś Małolepszy, Pascal Chevrel, and all the Persona localizers on Babelzilla (AtteL, dogi, drry, Ersen Yoldac, fernph, Funkin2x, funTomas, Joergen, jojaba, jooliaan, kkemenczy, kustodian, Lisman, lois, loveleeyoungae, moZes, pia, SiiiE, spjutster, steekid, stoyan, Wareczek, and wtspout), who worked diligently to ensure that Personas is accessible in as many languages as possible.
  • Rainer Cvillink who, on a shoestring budget, imaginatively developed the original Personas video:

    <iframe class="embeddedvideo" height="300" src="http://vimeo.com/moogaloop.swf?clip_id=3841582&amp;server=vimeo.com&amp;show_title=1&amp;show_byline=1&amp;show_portrait=0&amp;color=&amp;fullscreen=1" type="application/x-shockwave-flash" width="400"></iframe>

    Getting Started with Personas from Mozilla Labs on Vimeo.

What’s Next?

Between now and 20 million downloads, we’re looking to make this feature even better and easier to use. To continue to evolve Personas quickly, and in the right direction, we need your feedback and participation. Join the conversation in the discussion forum and add helpful hints to the support wiki. And stay tuned to this blog for updates!

- Suneel Gupta & Myk Melez on behalf of the Personas development team

The Mozilla BlogFirefox Beta 3.6 (revision 3) now available for download

Editor’s note: Mozilla released Firefox 3.6 beta 3 on Tuesday, November 17, 2009. Check out the Mozilla Developer News announcement reposted below for more details.

Last night the Mozilla community released Firefox 3.6 Beta 3, making it available for free download and issuing an update for all Firefox 3.6 beta users. This update contains over 80 fixes from the last Firefox 3.6 beta, containing many improvements for web developers, Add-on developers, and users. More than half of the thousands of Firefox Add-ons have now been upgraded by their authors to be compatible with Firefox 3.6 Beta. If your favorite Add-on isn’t yet compatible, you can also download and install the Add-on Compatibility Reporter – your favorite Add-on author will appreciate it!

The Mozilla community appreciates your feedback and assistance in testing this preview of the next version of Firefox. Your beta software will update itself periodically, and eventually will be updated to the final release itself.

The Beta of Firefox 3.6 / Gecko 1.9.2 introduces several new features for users to evaluate:

Web developers and Add-on developers should read more detail about the many new features in Firefox 3.6 for developers on the Mozilla Developer Center. For the full list of changes since the alpha release, see this list (it’s big).

Please use the following links to download Firefox 3.6 Beta, or visit the beta download page:

As always, the Mozilla community would appreciate hearing about any feedback you have about this release, or any bugs you may find.


Henri SivonenSpeculative HTML5 Parsing Landed

As mentioned earlier, there is an ongoing project for replacing Gecko’s old HTML parser with an HTML5 parser. Today, a significant milestone landed: off-the-main-thread speculative HTML5 parsing.

This means that the HTML source arriving from the network is not parsed on the main thread. (Browsers have traditionally been single-threaded.) Also, when the main thread is waiting for a script to load or execute, the rest of the HTML file is parsed ahead speculatively. This doesn’t mean merely scanning the rest of the file for URLs. It means running the HTML5 tokenization and tree building algorithm speculatively.

Bad use of document.write can cause speculation to fail and parsing work to be wasted. There is preliminary documentation for avoiding speculation failures.

The HTML5 parser continues to be turned off by default, so this landing shouldn’t disrupt your browsing with nightlies if you haven’t opted in to HTML5 parsing.

How to Try It?

First, this isn’t release-quality software. Testing the HTML5 parser carries all the same risks as testing a nightly build in general, and then some. It may crash, it may corrupt your Firefox profile, etc. If you aren’t comfortable with taking the risks associated with running nighly builds, you shouldn’t try the HTML5 parser.

If you are still comfortable with testing, download a trunk nightly build tomorrow, run it, navigate to about:config and flip the preference named html5.enable to true. This makes Gecko use the HTML5 parser when loading pages into the content area and when setting innerHTML. The HTML5 parser is not used for HTML embedded in feeds, Netscape bookmark import, View Source, etc., yet.

The html5.enable preference doesn’t require a restart to take effect. It takes effect the next time you load a page.

There is also another preference called html5.offmainthread that defaults to true. If you suspect a thread collaboration bug, you can try flipping the pref to false to make all parts of the HTML5 parser run on the main thread.

Known Problems

First and foremost, please refer to the list of known bugs. In particular, please be aware that there’s a known crash for which the fix hasn’t landed yet: If document.write writes an external script followed by an unbalanced start tag and the script ends without writing a corresponding end tag, the browser crashes.

Note that the speculative parsing landing does not fix the known Web compatibility bugs that have already been reported. The landing consists of changes to the way the parser integrates into Gecko.

What’s the Performance Impact?

Talos does not run to completion with the HTML5 parser enabled, so the impact is so far unknown. It is known that perceived performance is bad and will get better.

Reporting Bugs

Please file bugs in the “Core” product under “HTML: Parser” component with “[HTML5] ” at the start of the summary.

MozdevMozdev Community Organization Meeting - Nov 20th

The next Mozdev community meeting has been scheduled; we'd appreciate it if you can come by and discuss Mozdev's future.

Friday, Nov 20th
14:00 EST (19:00 UTC)
#mozdev on irc.mozilla.org

The meeting will be logged and will be available here:
http://irc.mozdev.org/logs.html

The agenda is currently very similar to the last meeting's agenda but we will probably spend less time on finances and committee organization:

http://www.mozdev.org/drupal/wiki/Community-Org-Meeting-Agenda-Nov-20

You may want to review the logs from the last meeting for background:

http://irc.mozdev.org/logs/Mozilla/%23mozdev/2009/11/%23mozdev.2009-11-14.log

Mozilla Developer DevNewsFirefox Beta 3.6 (revision 3) now available for download

Last night the Mozilla community released Firefox 3.6 Beta 3, making it available for free download and issuing an update for all Firefox 3.6 beta users. This update contains over 80 fixes from the last Firefox 3.6 beta, containing many improvements for web developers, Add-on developers, and users. More than half of the thousands of Firefox Add-ons have now been upgraded by their authors to be compatible with Firefox 3.6 Beta. If your favorite Add-on isn’t yet compatible, you can also download and install the Add-on Compatibility Reporter – your favorite Add-on author will appreciate it!

The Mozilla community appreciates your feedback and assistance in testing this preview of the next version of Firefox. Your beta software will update itself periodically, and eventually will be updated to the final release itself.

The Beta of Firefox 3.6 / Gecko 1.9.2 introduces several new features for users to evaluate:

Web developers and Add-on developers should read more detail about the many new features in Firefox 3.6 for developers on the Mozilla Developer Center. For the full list of changes since the alpha release, see this list (it’s big).

Please use the following links to download Firefox 3.6 Beta, or visit the beta download page:

As always, the Mozilla community would appreciate hearing about any feedback you have about this release, or any bugs you may find.

Mozilla Add-ons BlogThanks for the compatibility reports!

A few weeks ago, we launched the Add-on Compatibility Reporter, a way for Firefox users to let us know if their incompatible add-ons were working properly or having issues. As of tonight, we’ve received 25,000 reports on 2,000 add-ons for Firefox 3.6 betas alone!

We just dispatched emails to the developers of those add-ons as follows:

  • 105 add-ons that we think are compatible. These add-ons had more than 80% of reports saying the add-on worked fine. For these add-ons, we suggest that the developer test the add-on out themselves and then bump compatibility to Firefox 3.6.*.
  • 24 add-ons with compatibility issues. These add-ons had more than 80% of reports saying that the add-on was not functioning properly. We ask the developers of these add-ons to review the submitted reports and look into the issues mentioned before bumping compatibility.
  • 321 add-ons with mixed reports. These add-ons have received a number of reports, but we couldn’t make a guess as to the status. We encourage these developers to view the submitted reports and then test their add-ons before bumping compatibility.
  • 830 add-ons with at least one report, but not enough to determine anything. We’ve asked these developers to test their add-ons with Firefox 3.6 and bump compatibility if everything checks out.

The response to the Compatibility Reporter has been amazing, with almost 20,000 active users helping us out. Your reports will make a big difference in being able to ship Firefox 3.6 without add-on compatibility issues, so keep it up!

ShareThis

Wladimir PalantMercurial over HTTPS - ouch, SSL isn't always secure

I set up my Mercurial server as HTTPS only. The idea behind it was that establishing a secure communication channel outweighs the disadvantages (server load, more traffic and somewhat slower pull operations) for a small server like that. But then I had second thoughts — I am using a StartCom certificate that isn’t yet accepted everywhere, what if somebody cannot pull the repository because of that?

So the question is which certificate store Mercurial is using to validate certificates. A quick Google search didn’t bring up anything relevant, I simply had to test it. And I discovered that Mercurial doesn’t validate server certificates at all! It doesn’t matter whether the server uses a self-signed certificate or whether the certificate is issued to a different server, Mercurial accepts them all. Which makes using HTTPS rather pointless, there are MITM tools that will easily intercept that connection if you are on a public WLAN network for example.

I originally planned to allow push via HTTPS if I need to give other people access, this is easier to set up. With what I learned now however I will better take the time and configure push via SSH. I just wished there would be a warning about this in the Mercurial documentation, as it is now the documentation suggests that publishing repositories via HTTPS is secure while the same thing over HTTP isn’t. And it is not like the developers aren’t aware of the problem (last two paragraphs).

Meeting Notes from the Mozilla communitySeaMonkey Meeting Minutes: 2009-11-17

SeaMonkey:StatusMeetings:2009-11-17

From MozillaWiki

« last meeting | index

SeaMonkey Meeting Details


  • Who’s taking minutes? -> Ratty


(who needs to do what that hasn’t been recorded in a bug) We should assign people to the open items.

NEW

  • KaiRo to add to the known issues page additional items from the SeaMonkey 2.0 Final/Feedback section below.

  • Ratty to draft out some messages to encourage extension authors to make their extensions compatible with SeaMonkey 2.0. Once the Council approves them, we can forward to AMO for spammingdissemination.

OPEN

  • Get permission from Google to use their geolocation JSON service [KaiRo]. Contact at Google says: “We don’t have a good estimate for when GLS will be opening up more broadly, but I will be sure to let you know when we take that step. Sorry that I can not be more specific at this time.” – We can only wait right now.

    • KaiRo emailed Google again more than 8 weeks ago and again 5 weeks ago, no reply yet, even though the MoCo geolocation contact has poked the Google contact as well.

CLOSED


  • Shipped on October 27!

  • 167 fixed-seamonkey2.0 bugs (all post 2.0b2)!
  • Pushed venkman perf hit and GetDefaultReader to 2.0.1.
  • 2.0 has 19 official languages including en-US, as well as a beta/unofficial Turkish version (requested by localizer due to incomplete L10n). More to come for 2.0.1.
  • What are we going to do with regards to 1.9.1.6?
    • 2.0.1 will be based on 1.9.1.6 now as 1.9.1.5 was a crash-fixer released on Thursday 5th November, and KaiRo did not have enough time to generate a release that week.

    • Firefox is in slushy code freeze and is on schedule for a mid-December release.
  • Feedback
    • Many positive messages.

    • Also many posts with problems, a few common threads among those:
      • Failure to launch when installed over 1.x – can we do something with removed-files? Ratty has filed bug 526202 on this issue.

        • Components dumped by extensions into the application/components/ directory are definitely a problem.
      • Some things already mentioned in Known Issues.
      • Profile migration failures – not sure how to diagnose these. Things like missing all passwords in migration are strange, but hard to debug especially if we don’t have access to the users system.
      • The migration experience for people with multiple profiles is sub-optimal and we need to find some way of making this better.
      • Quicklaunch from SeaMonkey 1.1.x still enabled, need to see if it’s possible/wanted to disable Quicklaunch during SeaMonkey 2 setup (should not be that difficult). IanN keep an eye on this issue (bug 526204).
      • The new Password and Form Managers seem to be hard for people to grasp, do we need docs on those so we can point people to them? BenoitRen to file a bug and to contact people who can potentially help to do the documentation. There is an existing bug, bug 463903 for form autocomplete.
        • One immediate issue is for a form history editor to edit/delete incorrect entries. There is a Form History Manager extension for SeaMonkey 2.0 that can do this. But we need this as a native function of SeaMonkey for a better user experience. Perhaps we can use that extension as a starting point.

        • Ratty to file a but to track a native Forms editor.
      • For some users cut&paste isn’t working for some Windows 7 users. Specifically, nothing gets pasted (bug 525601.
        • This has been traced to the McAfee Site Advisor component of the McAfee Internet Security Suite (also shipped with other McAfee products and with Yahoo security suites that are rebranded McAfee). Latest reports indicate that this problem only surfaced after RC2 because in previous versions of the McAfee Security Suite, the Site Advisor was an optional component. However the in latest versions the Site Advisor cannot be deselected. Also users with McAfee subscriptions who auto-updated got the Site Advisor whether they wanted it or not.

        • The McAfee techs would like a developer from the SeaMonkey side to assist them in tracking down the problem. Do we have someone with the required skillset? Perhaps Neil.
      • Some users upgrading from 1.1 who never used a master password are now being prompted at every startup for a (non-existent) password. In 1.1 it was possible to set a master password but not use it if the preferences were set that way. Some users might have accidentally set a master password and forgot about it and this could have been migrated to the 2.0 profile. Unfortunately in 2.0 if a master password is set then it is used.
      • We seem to have accidentally migrated from 1.1 all the “browser.toolbars.showbutton.*” preferences when we shouldn’t. The most common case appears to be the home button. Our button pref listener are still active because of the Go and Search buttons in the URL bar.
        • Ratty to file a bug to fix or workaround the problem in 2.0.1 for already migrated profiles. Also possibly get someone to look at the profile migrator code to not migrate these preferences.


Bug statistics for last two (full) weeks: 65 new, 20 fixed, 58 triaged.

  • High rate of new bugs immediately after 2.0 release but declining.

  • Fixing rate down as we all take a breath after this.
  • Triage rate up from 34 at last meeting.

Major wanted/needed features:


  • bug 423281 Help updates.

    • Status/Progress?
  • bug 483282 Make sure normal SeaMonkey use doesn’t pay a price for having venkman installed.
    • Needs at least a core patch landing for 1.9.1.6 (.5 will be a short-cycle crash-fixing update) bug 364864 nsICategoryManager::deleteCategoryEntry does not persist outside of component registration.

    • Progress/Status?
  • bug 471346 Port GetDefaultFeedReader to SeaMonkey shell service. New patch needed.
    • New patch needed.


  • bug 460953 kill-rdf port [sgautherie]

    • Progress stalled.
  • bug 436794 Enable Mac OS X system address book per default and add UI.
    • SM UI needed, unowned, helpwanted.
  • bug 410613 OpenSearch. helpwanted.
    • We need to check if OpenSearch can support all our existing functionality, for example the INTEPRETS section in Sherlock search plugins. Mnyromyr will check on that, and on how extensible the Firefox code is.
  • bug 449728 drag tabs between windows
    • unowned so far.
  • bug 498596 places bookmarks
    • unowned so far.
  • bug 477845 Build a standalone (Gecko 1.9.1) Composer
    • Will look into that once KompoZer 0.8 is done.
  • bug 477840 Backport KompoZer to Composer
    • Will look into that once KompoZer 0.8 are done.
  • bug 523274 Complete new default theme icon set
    • status/progress?

    • A list of TODO icons is up in the bug
    • Still needs quite a bit of work.
    • bug 522023 is working on improving the browser globe in task icons, etc..
  • bug 526210 Update the icon set for the SeaMonkey Modern Theme.
    • unowned so far.
  • bug 521927 Make Search, Folder Location and Views widgets for MailNews customizable toolbars.
    • waiting on reviews (was previously waiting on bug 525373 to be checked in).

We also should take a look at the other items on wanted-seamonkey2.1+


Status Updates from developers – what are you working on, what’s the progress, any other comments? (feel free to add yourself to the list if your name is missing and you have interesting status).







  • Usual testing, reviewing and commenting.

  • Bugs fixed:
    • bug 525373 Make customizable toolbars play nicely with children with disabled attributes (toolkit) – checked into mozilla-central, waiting on approval for mozilla-1.9.1
  • Working on:
    • bug 439134 “Customize toolbars” window a bit too small on linux – cuts off the “Restore defaults” button – new patch up and waiting for reviews.

    • bug 515967 Add icons to addressbook menulist in Search Addresses.
    • bug 519133 Newsgroup list in Message Filters Dialog has blank entry and extra separator.
    • bug 521927 Make Search, Folder Location and Views widgets for MailNews customizable toolbars – waiting on reviews (was previously waiting on bug 525373 to be checked in).


  • Bugs Fixed:

  • Worked on extension compatibility (DictionarySearch)
  • Wrote my first own extension (Bookmark Indicator)



  • Helping out in the Mozillazine SeaMonkey Support forum ;)

  • Assigned:
    • bug 471346 Port GetDefaultFeedReader to SeaMonkey shell service

    • bug 507896 Upgrading Seamonkey changes file type icon for HTML files to mail.


Bugs fixed:

Bugs working on:


Working on:

  • bug 456874 Need a policy/rule of thumb, for new prefpane usage by extensions.

  • bug 521803 tabbrowser.xml: “Error: this.mPanelContainer is null”, opening MailNews.
  • bug 521891 Need pref pane entry for extension blocklist feature.



Fixed:

  • bug 520366 AppendInt only handles 32 bit signed ints

  • bug 525725 xulrunner -help crashes [@ LoadPlatformDirectory]
  • bug 524256 stacks not unwound past XPCWrappedNative::CallMethod

Working on:

  • bug 520535 titlebar=no windows do not receive events

  • bug 503794 Unable to remove an attachment during compose
  • bug 152526 Send Link does not open configured external app
  • bug 525047 ‘make clean’ in srcdir deletes automationutils.py
  • bug 528755 Find a place for filepicker’s filter strings to live

Plus the usual review backlog, of course…


  • Bugs fixed:

    • bug 528209 When working Offline and composing an e-mail the “Send” button doesn’t change to “Send Later”.
  • Working on:
    • bug 528506 In the SeaMonkey Default Theme Account Central pane, the icon in the “create new calendar” row is misaligned.
  • Filed AMO bug 527919 (Obtain a list of extension author email addresses so that the SeaMonkey Council can mass mail them) on behalf of KaiRo and monitoring it.
  • Bug triage and Bug discussions including:
    • Tracking McAfee issue with bug 525601 Copy and cut (clipboard) functions do not work in SM 2.0.
  • AgitProp and PR in http://forums.mozillazine.org/
  • Answering questions in the Mozillazine SeaMonkey Support forum.

Note:

  • Currently I am concentrating on my own extensions as well as my extensions port project and won’t be too active in SeaMonkey development for a while – at least until 2.1 development starts to ramp up.




Bugs fixed:

  • bug 525404 [Mac Classic] Appearance Pref Pane does not alter icon/text settings [Fixed on 2.0 branch].

Working on:

  • bug 525698 [Mac Classic] Need new css for pageinfo.

  • bug 525926 [MacOSX] Sub-menus in native Bookmarks menu have “Empty” menuitem.
  • bug 528752 [Mac Classic] History drop-down height doesn’t match full number of rows.



  • Thunderbird mass-mailed Thunderbird extension authors on AMO reminding them to update their extensions for Thunderbird 3.0. We should do a similar mass mailing targeting two groups:

    • Existing SeaMonkey extensions that haven’t been upgraded to 2.0.

    • Firefox and Thunderbird extension authors encouraging them to make their extensions compatible with SeaMonkey 2.0.
    • Ratty filed AMO bug 527919. The way forward appears to be that we draft one or more messages and AMO will take care of sending these out to extension developers.
  • EOL date for SeaMonkey 1.1?
    • The plans for Gecko 1.8 are rather murky at the moment. KaiRo will probably try to get a clearer view when a 1.8.1.24 will be prepared possibly in December.

Meeting Notes from the Mozilla communityThunderbird Meeting Minutes: 2009-11-17

Thunderbird/StatusMeetings/2009-11-17

From MozillaWiki

last meeting | index | next meeting »

Thunderbird Meeting Details :





  • Planning for a dry-run security firedrill build

    • Fire drill itself expected to happen after code freeze



  • There will be a build 2 of RC 1.

    • Remaining code blockers ready to land waiting for tree to re-open following planned downtime of stage.mozilla.org.

    • Once blockers have landed we can start automation.


_Going on_ :

Testing of RC1 going strong – we’ve reached 90% test coverage on the largest tests sets. Results are visible at <https://litmus.mozilla.org/test_run_report.cgi?test_run_id=56>. Missing tests are related to Proxies. The QA team is busy following bugs and test results as well as testing. The team would like to thank all the people who signed in and are participating or will participate.

_This week_ :

Focus is going to be on testing RC1/build2 and following bug reports. So our focus is going to be on litmus, build2 and bugzilla.

_Crash stats_ :

No stats this week as rc1 is unreleased. We would like to note that some people are crashing while sending emails, or are having issues with nightlies and sending emails. This is likely due to an api change in TB that affects enigmail – if you are using enigmail please update to the latest nightly which fixes the issue. http://enigmail.mozdev.org/download/nightly.php




  • sick last week

In Progress

TODO

  • msg headers (466025, 480623)

  • new bug for debugging issues? (and close 420317?)
  • TB usage of XUL elements, content-in-a-tab
  • collapsed threads (bug 496244 454829) (DavidA)


  1. Top 5 GS Thunderbird 2 Support Topics (code in progress: http://gist.github.com/190923 ) basically the same as last week

    1. Cannot send email (ongoing issue with 2 AT&T Yahoo customers, no pattern, other AT&T Yahoo customers fine!)

    2. Cannot receive email
    3. migration to Vista and Windows 7 from XP – need to write a KB article for this
    4. email lost (fixed by compacting folders and deleting .msf)
    5. importing address books – need to write a KB article for this
  2. Thunderbird 3 Beta Top Support Issues (starting to monitor to see what we can improve for post 3.0)
    1. 2 reports of not being able to send or receive email when upgrading 2.0.0.23 to TB 3 RC1 Build 1 non en-US version e.g. GB- fixed by copying signons.sqlite
  3. SUMO for MoMo tracker ticket: https://bugzilla.mozilla.org/show_bug.cgi?id=520628, TB3 Global Database KB
    1. theme work slowed because gozer was sidetracked into RC1 build work, looking to make much more progress this week

    2. Lightning Docs wiki page created with rough list of topics
  4. Key Support stats from the following graphic:
    1. approximately 25/ day (176/7, slightly higher than last week if we subtract the Raindrop topics)

    2. total new topics:176 total replies: 64 (Ruby Code)
      1. date:20091110 #new support topics:20 resolved: 9

      2. date:20091111 #new support topics:29 resolved: 3
      3. date:20091112 #new support topics:28 resolved: 3
      4. date:20091113 #new support topics:24 resolved: 5
      5. date:20091114 #new support topics:13 resolved: 7
      6. date:20091115 #new support topics:13 resolved: 0
      7. date:20091116 #new support topics:1 resolved: 10
    3. #replies from non MoMo folks: 103 from pasa (many were about his problems but some helped others and welcome!), 8 from from gyurrika (thanks!) MoMo folks: 1 from Wayne Mery (thanks) 38 from Roland (down because I was sick for 2 days), Bienvenu 11 (thanks!), 3 from Standard8 (thanks), 7 from Kent James (thanks) 2 from Lighning team (thanks!)
    4. happiness metric: API doesn’t have happiness emotitags, asked GS staff about that, code in progress: http://gist.github.com/190094, manual happiness metric = 64 – 38 = 26 (26 last week), 33 Hendrix messages (generally Hendrix messages are unhappy but this week we had 3 happy messages) – bug to track down Hendrix for Thunderbird 3 and get rid of it as much as possible






  • Last Week

    • Driving

    • Reviews
    • A11y/message header work
    • misc catchup
  • This Week
    • Roadmap work

    • Reviews




  • Reviews and Driving

  • fix move/copy file menu not to allow move/copies to virtual folders, servers and other canFile==false folders, 3.0 and trunk bug 528690
  • Fixed bug 527679 gloda indexing does not properly handle undone message deletions, 3.0 and trunk, with secret help from Asuth.
  • Fixed bug 527836 – imap not setting public namespace from prefs correctly, 3.0 and trunk.
  • Stop imap code touching prefs service off the ui thread bug 83489, trunk only
  • Landed last fixes for bug 518678, fix copy chaining to same folder in copycompleted notification, and add unit test that asserts w/o fix, trunk only.
  • Started looking at trunk regressions.
  • Started thinking about TB 3.1


  • Build

    • TB 3.0 RC1 Build1

    • Lightning trunk builds
    • Packaged gcc-4.3.3 and upgraded the linux slave to the Linux refplatform v20
  • Web

    • Met with the TikiWiki folks at TikiFest4 – Montreal

    • Working with Gary@tiki to get more work done on the theme for SuMoMo
    • STB security updates
    • Tinderbox Pushlog updates
  • Infrastructure

    • LAN hg.m.o mirror for the minis


  • Last Week

    • Sick

    • Vacation
  • This Week
    • Catch up on

      • ui-reviews

      • bugs
      • driving schedule
      • 3.1 roadmap


  • audited and cleaned up numerous crash bugs

  • began audit of sg/security bugs
  • filed crash & hang bugs:
    • bug 528843 crash [@ nsRefPtr<nsSpeculativeScriptThread>::assign_assuming_AddRef(nsSpeculativeScriptThread*)]

    • bug 528505 hang after starting 3.0rc1
    • bug 528368 crash during spell check [@ nsTextServicesDocument::IsBlockNode(nsIContent*)]
    • bug 528345 crash composing message [@ FindNextNonWhitespaceSibling]
    • bug 527801 startup crash [@ js_LockGlobal]
    • bug 526935 crash [@ nsMsgDBView::NoteChange(unsigned int, int, int)]
  • additional credits changes
  • spot checked SM mailnews bugs
  • set up bugzilla whine to monitor new crash bugs






  • RC1 work.

  • Working on PR contract for next few months, next year.
  • Got Windows 7 up and running.
  • Trying hard not to get sick.
  • Taking vacation day on Friday.

Next week

  • Website l10n driving.

  • Add-ons contest scoping.


  • working and following rc1.


Last week:

This week:

  • Upload sources to svn

  • More ISP:s to add (and get more people involved)
  • More polish


Last week:

This week:

  • Review some bugs.

  • Write some more code.
  • Continue to help students with ISPDB.



  • Fixed (or in-progress) MailNews Core bugs:

    • bug 521618 Port |Bug 520339 – Remove leftovers from MOZ_COMPONENTLIB| to comm-central

    • bug 522713 Port |Bug 448602 – Have a way to enumerate event listeners| to comm-central (apps)
    • bug 524349 Port |Bug 517417 – access violation: while compiling xulrunner tries to test for Mercurial repositories above its build dir| to comm-central
    • bug 459693 Eliminate nsFileSpec and nsIFileSpec (references) from MailNews
    • bug 521624 Port |Bug 517355 – Restore OJI, Liveconnect and the JEP on the 1.9.2 branch on OS X| to comm-central (apps)



  • No Beta blocker bugs left (1 checkin open), waiting for the remaining locales until Nov 21st.

  • Will release 1.0b1rc1 shortly after
  • Working on buildbot part of making nightlys localized (bug 346278)
  • Might need some help with the release engineering part of our beta release.


Meeting Notes from the Mozilla communityMozilla Platform Meeting Minutes: 2009-11-17

Platform/2009-11-17

From MozillaWiki

« previous week | index | next week »


Firefox 3.0.16 / Firefox 3.5.6

  • 3.5.6: Everything in, but we found on regression we need to fix.

  • 3.0.16: One patch to land and the same regression to fix.
  • still on track for both releases

Firefox 3.0.17 / Firefox 3.5.7

  • no schedule for either release yet

  • will start marking blockers this week and sending out emails to blocker owners
  • tree should open in early December

Firefox 3.6 Beta

  • beta user base is now over 300,000

  • beta 3 refresh shipping later tonight

Firefox 3.6 Release Candidate

  • tree was closed for a lot of this morning

  • blocker counts haven’t come down appreciably, though 1/4 of them are “crashkill”
  • what does this mean for schedule?


See more Firefox 3.6 related blocker queries, or learn about the new status and blocker flags


(Progress reports every weekend on Planet Firefox)

  • see our active projects and get involved / propose others

  • Namoroka/mozilla-1.9.2 front end development:
    • 21 blockers left, 9 are crashkill

    • bug 519438 and bug 496019 are confusing and annoying, will likely require a late compatibility-breaking fix
    • bug 526194 is actually responsible for a bunch of the blockers which are dependencies of the main fix
    • all blockers have patches in progress except for DLL blocklist and credits bugs
    • should be done by Thursday


  • 6 1.9.2 blockers

    • Most are well-controlled and will be ready. But bug 518506 is scary, and its fix is scarier. Karl suggests that he could be ready by EOD Wednesday, but it’s not a certain thing.
  • Everyone is heads-down working on 1.9.2 or Electrolysis.
  • Aero peek per-tab preview work is stopped, because Rob Arnold’s development machine has died.
  • Jeff is working on a scrolling performance pageset. If you have any pages that you know scroll slowly, please add them to bug 527728.


  • 1.9.2 blockers

    • 16 blockers (spike of incoming bugs)

    • On top of them:
      • 5 fixed on trunk

      • 7 will be fixed by patches that need landing
      • 3 need review
      • last one is a crashkill
    • 5 noms: 3 with patches that need landing, 1 fixed on trunk, 1 won’t block
    • 522088/507294 landed just now


  • 12 content blockers left

    • 5 crashkill bugs

    • 4 blockers waiting to land
    • 3 blockers waiting for reviews
    • 0 blockers w/o patches.
  • Continuing to investigate cycle collector crashes (peterv)
  • JPW work moving along (bnewman)
  • HTML5 parsing off the main thread work starting to land (hsivonen)



  • Lots of work on crash kill bugs, with good progress.

  • blockers: looks like we should be able to close out the blockers soon, but maybe not by tomorrow/freeze, but we shouldn’t go over much. The below are TraceMonkey landing estimates; how those make it to M-C will be up to sayrer.
    • bug 523846 expected 2009-11-17, Waldo says “easy peasy”

    • bug 526173 expected 2009-11-18 luke’s patch is waiting for review from Waldo, which Waldo expects to be done by end of 2009-11-17. Once landed, expecting our String.indexOf to be faster than webkit.
    • bug 519719 expected 2009-11-18 jorendorff has patch, not sure about perf impact
    • bug 505523 expected 2009-11-17 jorendorff has patch in bug, will land in tm today
    • bug 524454 expected 2009-11-17 jorendorff says is is a dup of 505523
    • bug 528116 expected 2009-11-18 igor
  • jimb has 14 strict mode patches in final approach; tracking bug bug 482298


  • Latest weekly update is here.

  • Dirty-cold-Ts went live this week, thanks to Alice and Lukas. Example: cold startup with a large places.sqlite on Mac.
  • Snapshot results for startup and all other tests are now *live* (thanks Catlee): http://graphs.mozilla.org/dashboard/snapshot/
  • Joel is making progress on making a super-static Firefox in bug 525013. He’s got a static XUL working, moving on to XPCOM next.
  • Ben is making progress on the fastload replacement in bug 520309.
  • Taras has patches up for service caching (bug 516085 and super-fast-path-ing of Components.* (bug 512584).
  • More patches and data about Mac font-loading by Jonathan Kew and John Dagget in bug 519445.
  • Ryan put up some details about when spellcheck is initialized, a couple of potential solutions in bug 496217.
  • Ted landed rebasing on Windows in bug 484799.
  • Drew’s work on getting rid of Change GetPersistentDescriptor/SetPersistentDescriptor on Mac, has landed in bug 506814.


pending reviews
feature review date who interested
Windows TSF integration (1.9.2) unscheduled Jim Chen, roc
DNS Prefetching unscheduled Patrick McManus Jesse, bz, reed(?), ctalbert
New system metrics (and media queries) unscheduled ? dbaron

Top Security Bugs



  • Downtimes:

    • today: IT upgraded stage to RHEL5 (long-delayed). Back up now, trees will re-open very soon.

    • thursday AM EST: try server, to reclone the repo
      • working on a solution to do this automatically bug 529179
    • saturday all day: power outage rescheduled to Sat. Nov. 21st. Reminder that mobile coverage will be down, same plan as last time. Aki handling things on the RelEng side.
  • talos for e10s
  • new talos tests:
    1. v8

    2. tsvg_opacity
    3. dirty+cold startup tests
    4. measuring x resources during linux tp4 runs
  • more n810s (40) and 30+ minis coming online


  • Orange + blocker bug 519438 – anyone know GTK and event loop crash madness? -dietrich

  • bug 513747 prevents running mochitests for people on 10.6. Should we have tinderbox coverage? Can we really ship with this? – sicking
  • If anyone needs minidumps for crash bugs, talk to jst

Myk MelezThe Skinny on Raindrop's Mailing List Extensions

Raindrop is an exploration of messaging innovation that strives to intelligently assist people in managing their flood of incoming messages. And mailing lists are a common source of messages you need to manage. So, with assistance from the Raindrop hackers, I wrote extensions that make it easier to deal with messages from mailing lists.

Their goal is to soothe two particular pain points when dealing with mailing lists: grouping their messages together by list and unsubscribing from them once you're no longer interested in their subject matter.

This post explains how the extensions do this; touches on some aspects of Raindrop's message processing and data storage models; and speculates about possible future directions for the extensions.

Raindrop Extensibility

Raindrop is being built with the explicit goal of being broadly and deeply extensible, and it includes a number of APIs for adding and modifying functionality. The mailing list enhancements comprise two related extensions, one in the backend and one in the user interface.

The backend extension plugs into Raindrop's incoming message processor, intercepting incoming email messages and extracting info about the mailing lists to which they belong. It also handles much of the work of unsubscribing from a list.

The frontend extension plugs into Raindrop's Inflow application, modifying its interface to show you the most recent mailing list messages at a glance, group mailing list conversations together by list, and provide a button you can press to easily unsubscribe from a mailing list.

Message Processing and Data Storage

Before getting into how the extensions work, it's useful to know a bit about how Raindrop processes and stores messages.

Raindrop stores information using CouchDB, a document-centric database whose principal unit of information storage and retrieval is the document (the equivalent of a record in SQL databases). Documents are just JSON blobs that can contain arbitrary name -> value pairs (unlike SQL records, which can only contain values for predeclared columns).

To distinguish between different kinds of documents, Raindrop assigns each a schema (similar to a table in SQL parlance) that describes (and may one day constrain) its properties. The rd.msg.email schema is the primary schema representing an email message, while the rd.mailing-list is the schema representing a mailing list, and the rd.msg.email.mailing-list is a simple schema that associates messages with their lists.

(In an SQL database, rd.msg.email and rd.mailing-list would be tables whose rows represent email messages and mailing lists, while rd.msg.email.mailing-list would be a table whose rows map one to the other.)

Note that there's a many-to-one relationship between messages and lists, since messages belong to a single list, although lists contain many messages, so rd.msg.email.mailing-list isn't strictly necessary. Its list-id property (which identifies the list to which the message belongs) could simply be a property of rd.msg.email docs (or, in SQL terms, a foreign key in the rd.msg.email table).

But putting it into its own document has several advantages. First, it improves robustness, as it reduces the possibility of conflicts between extensions and core code writing to the same documents.

It also improves write performance, as it's faster to add a document than to modify an existing one (although index generation and read performance can be an issue).

Finally, it improves extensibility, because it makes it possible to write an extension that extends the backend mailing list extension.

That's because Raindrop's incoming message processing model allows extensions to observe the creation of any kind of document, including those created by other extensions.

So just as the mailing list extension observes the creation of rd.msg.email documents, another extension can observe the creation of rd.msg.email.mailing-list documents and process them further in some useful way. If the mailing list extension simply modified the original document instead of creating its own, that would require some additional and more complicated API.

The Backend Extension

The primary function of the backend extension is to examine every incoming message and dress the ones from mailing lists with some additional structured information that the frontend can use to organize them.

Backend extensions are accompanied by a JSON manifest that tells Raindrop what kinds of incoming documents it wants to intercept. The mailing list extension's manifest registers it as an observer of incoming rd.msg.email documents, which get created when Raindrop retrieves an email message:
"schemas" : {
"rd.ext.workqueue" : {
"source_schemas" : ["rd.msg.email"],
...

The extension itself is a Python script with a handler function that gets passed the rd.msg.email document and looks to see if it contains a List-ID header (or, in certain cases, another identifier) identifying the mailing list from which the message comes:
def handler(message):
...
if 'list-id' in message['headers']:
# Extract the ID and name of the mailing list from the list-id header.
# Some mailing lists give only the ID, but others (Google Groups,
# Mailman) provide both using the format 'NAME <id>', so we extract them
# separately if we detect that format.
list_id = message['headers']['list-id'][0]
...

If it doesn't find a list identifier, it simply returns, and Raindrop continues processing the message:
if not list_id:
logger.debug("NO LIST ID; ignoring message %s", message_id)
return

Otherwise, it calls Raindrop's emit_schema function to create an rd.msg.email.mailing-list document linking the message document to an rd.mailing-list document representing the mailing list:
emit_schema('rd.msg.email.mailing-list', { 'list_id': list_id })

In this function call, rd.msg.email.mailing-list is the type of document to create, while { 'list_id': list_id } is the document itself, written as Python that will get serialized to JSON.

A document created inside a backend extension like this automatically gets a reference to the document the extension is processing (i.e. the rd.msg.email document), so the only thing it has to explicitly include is a reference to the list document, in the form of a list_id property whose value is the list identifier.

The extension also checks if there's an rd.mailing-list document in the database for the mailing list itself, and if not, it creates one, populating it with information from the message's List-* headers, like how to unsubscribe from the list. Otherwise, it updates the existing mailing list document if the message's List-* headers contain updates.

The Frontend Extension

The frontend extension uses the information extracted by the backend to help users manage mailing lists in the Inflow application.

It adds a widget to the Home view that shows you the last few messages from your lists at the bottom of the page, so you can keep an eye on those messages without having to give them your full attention:




It adds a list of your mailing lists to the Organizer widget:




And when you click on the name of a list, it shows you its conversations in the conversation pane:




In traditional mail clients, users who want to break out their list messages into separate buckets like this typically have to create a folder for each list to contain its messages and then a filter for each list to move incoming list messages into the appropriate folders. The extension does this for you automatically!

Finally, while viewing list conversations, if the extension knows how to unsubscribe you from the list, it displays an Unsubscribe button:




Pressing the button (and then confirming your decision) unsubscribes you from the list. You don't have to do anything else, like remembering your username/password for some web page, sending an email, or confirming your request with the list admin. The extensions handle all those details for you so you don't have to know about them!

List Unsubscription

In case you do want to know the details, however, it goes like this...

First, the frontend extension sends a message to the list's admin address requesting unsubscription, with a certain command (like "unsubscribe") in the subject or body of the message (lists often specify exactly what command to send in the mailto: link they include in the List-Unsubscribe header):
From: Jan Reilly <jan>
To: wasbigtalk-admin@example.com
Subject: unsubscribe</jan@example.com>

Then the server responds with a message requesting confirmation of the request, often putting a unique token into the Subject or Reply-To header to track the request:
From: wasbigtalk-admin@example.com
To: jan@example.com
Subject: please confirm unsubscribe from wasbigtalk (4bc3b7e439fd)

Hello jan@example.com,

We have received a request to unsubscribe you from wasbigtalk.
Please confirm this request to unsubscribe by replying to this email.
...

Then the backend extension responds with a message confirming the request that includes the unique token:
From: jan@example.com
To: wasbigtalk-admin@example.com
Subject: Re: please confirm unsubscribe from wasbigtalk (4bc3b7e439fd)

Finally, the server responds with a message confirming that the subscriber has, indeed, been unsubscribed:
From: wasbigtalk-admin@example.com
To: jan@example.com
Subject: you have been unsubscribed from wasbigtalk

Hello jan@example.com,

Your unsubscription from wasbigtalk was successful.
...

At this point, the backend extension marks the list unsubscribed in the database, and the frontend extension marks it unsubscribed in the user interface.

This process matches the way much mailing list server software works, although there are daemons in the details, so the extensions have to be programmed to support each server individually.

Currently, they know how to handle Google Groups and Mailman lists. Majordomo2 (used by the Bugzilla and OpenBSD projects, among others) is not supported, because it doesn't send List-* headers (alhough supposedly it can be configured to do so). The W3C's list server is not yet supported, although it does send List-* headers, and support should be fairly easy to add.

Note that some of the processing the extension does is (locale-dependent) "screen"-scraping, as Google Groups and Mailman don't consistently identify the list ID and message type in some of their correspondence. In the long run, hopefully server software will improve in that regard. Perhaps someone can spearhead an effort to make it so?

The Future

The extensions' current features fit in well with Raindrop's goal of helping people better handle their flood of incoming messages. But there is surely much more they could do to help in this regard.

Besides general improvements to reliability and robustness--like support for additional list servers and handling of localized admin messages--they could let you resubscribe to a mailing list from which you've unsubscribed. And perhaps they could automatically fetch the messages you missed while you were away. Or even retrieve the entire archive of a list to which you're subscribed, so you can browse the archive in Raindrop!

What bugs you about mailing lists? And how might Raindrop's mailing list extensions make them easier (and even funner) to use?

Nicholas NethercoteNanojit test coverage

On i386, Nanojit has two basic modes of operation: SSE, and non-SSE. Non-SSE is for old machines that don’t support SSE instructions. (It might actually be SSE2 instructions, I’m not sure.) My two machines both support SSE and so the non-SSE is never exercised unless I specify the environment variable X86_FORCE_SSE=no. Since this invocation doesn’t exactly roll off the fingertips, I don’t do it often. It’s also easy to mistype, in which case the normal SSE code will be run but I probably won’t notice and so I’m testing something different to what I think I am testing.

I recently committed a patch (bug 516348) that broke the non-SSE mode. (It may have also broken the SSE mode, but in a less obvious way.) Whenever I land a patch that breaks something, I try to work out if I could have avoided the breakage through a better process. In this case I could have, through automation. I now have the following set of aliases and functions in my .bashrc:

alias jstt_prefix="python trace-test/trace-test.py"
JSTTARGS32="--no-slow -f -x sunspider/check-date-format-tofte.js"
JSTTARGS64="$JSTTARGS32"

alias jsdtt32="                   jstt_prefix debug32/js $JSTTARGS32"
alias jsott32="                   jstt_prefix opt32/js   $JSTTARGS32"
alias jsdtt32b="X86_FORCE_SSE2=no jstt_prefix debug32/js $JSTTARGS32"
alias jsott32b="X86_FORCE_SSE2=no jstt_prefix opt32/js   $JSTTARGS32"
alias jsott64="                   jstt_prefix opt64/js   $JSTTARGS64"
alias jsdtt64="                   jstt_prefix debug64/js $JSTTARGS64"

function jsatt
{
  if [ -d debug32 ] && [ -d debug64 ] && [ -d opt32 ] && [ -d opt64 ] ; then
    cd debug32 && mq && cd .. && \
    cd debug64 && mq && cd .. && \
    cd opt32 && mq && cd .. && \
    cd opt64 && mq && cd ..

    if [ $? -eq 0 ] ; then
      echo
      echo "debug32"          && jsdtt32   && echo
      echo "debug32 (no SSE)" && jsdtt32b  && echo
      echo "debug64"          && jsdtt64   && echo
      echo "opt32"            && jsott32   && echo
      echo "opt32 (no SSE)"   && jsott32b  && echo
      echo "opt64"            && jsott64   && echo
    fi
  else
    echo "missing one of debug32/debug64/opt32/opt64"
  fi
}

The code is boring. For those reading closely, it relies on the fact that I always put different builds in the directories debug32/, opt32/, debug64/, opt64/. And I skip check-data-format-tofte.js because it fails if you’re in a non-US timezone, see bug 515214.

I already had ‘jsdtt32′ et al, each of which tests a single configuration. But now with a single command ‘jsatt’ (which is short for “JavaScript All trace-tests”) I can run the JS trace-tests on 6 different configurations on a single x86-64 machine: 32-bit debug (SSE), 32-bit debug (non-SSE), 64-bit debug, 32-bit optimised (SSE), 32-bit optimised (non-SSE), 64-bit optimised. And it builds them to make sure they’re all up-to-date.

It’s only a small process change for me, but it means that it’s unlikely I will break any of these configurations in the future, or at least, not in a way that shows up in the trace-tests.